02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113240 Keywords=None Message=Started invocation of ScriptBlock ID: 705c35ce-c91d-4aeb-8235-ddbc30dd0a1c Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113239 Keywords=None Message=Completed invocation of ScriptBlock ID: 3d60f8bc-443e-457a-af11-455ffacabb8a Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113238 Keywords=None Message=Completed invocation of ScriptBlock ID: b80967b8-c43d-4513-868e-ebed106c0c42 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113237 Keywords=None Message=Started invocation of ScriptBlock ID: b80967b8-c43d-4513-868e-ebed106c0c42 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113236 Keywords=None Message=Started invocation of ScriptBlock ID: 3d60f8bc-443e-457a-af11-455ffacabb8a Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=12113235 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: 3d60f8bc-443e-457a-af11-455ffacabb8a Path: 02/18/2022 10:10:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113234 Keywords=None Message=Completed invocation of ScriptBlock ID: 705c35ce-c91d-4aeb-8235-ddbc30dd0a1c Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113506 Keywords=None Message=Started invocation of ScriptBlock ID: 705c35ce-c91d-4aeb-8235-ddbc30dd0a1c Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113505 Keywords=None Message=Completed invocation of ScriptBlock ID: 89ec9b96-2034-474a-8a75-be0ee6e9cc5e Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113504 Keywords=None Message=Completed invocation of ScriptBlock ID: b80967b8-c43d-4513-868e-ebed106c0c42 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113503 Keywords=None Message=Started invocation of ScriptBlock ID: b80967b8-c43d-4513-868e-ebed106c0c42 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113502 Keywords=None Message=Started invocation of ScriptBlock ID: 89ec9b96-2034-474a-8a75-be0ee6e9cc5e Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=12113501 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: 89ec9b96-2034-474a-8a75-be0ee6e9cc5e Path: 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113500 Keywords=None Message=Completed invocation of ScriptBlock ID: eb66c543-5eae-46cc-a960-5b118c8231b0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113499 Keywords=None Message=Started invocation of ScriptBlock ID: eb66c543-5eae-46cc-a960-5b118c8231b0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113498 Keywords=None Message=Completed invocation of ScriptBlock ID: b7c2ff8e-86b0-49df-9d57-b947cad47888 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113497 Keywords=None Message=Completed invocation of ScriptBlock ID: 8de2b9fe-761b-40f2-8543-552cf2a8950e Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113496 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113495 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113494 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113493 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113492 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113491 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113490 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113489 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113488 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113487 Keywords=None Message=Completed invocation of ScriptBlock ID: 273e9cf9-f096-4c96-a92f-1ff9e4c18b06 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113486 Keywords=None Message=Started invocation of ScriptBlock ID: 273e9cf9-f096-4c96-a92f-1ff9e4c18b06 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113485 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113484 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113483 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113482 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113481 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113480 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113479 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113478 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113477 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113476 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113475 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113474 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113473 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113472 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113471 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113470 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113469 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113468 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113467 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113466 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113465 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113464 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113463 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113462 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113461 Keywords=None Message=Completed invocation of ScriptBlock ID: 16dfc64b-328f-44f7-aa27-5ce711199ddf Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113460 Keywords=None Message=Started invocation of ScriptBlock ID: 16dfc64b-328f-44f7-aa27-5ce711199ddf Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113459 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113458 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113457 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113456 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113455 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113454 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113453 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113452 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113451 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113450 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113449 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113448 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113447 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113446 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113445 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113444 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113443 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113442 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113441 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113440 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113439 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113438 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113437 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113436 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113435 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113434 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113433 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113432 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113431 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113430 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113429 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113428 Keywords=None Message=Completed invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113427 Keywords=None Message=Started invocation of ScriptBlock ID: 95f709be-7746-404d-85ca-e1a8a0799375 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113426 Keywords=None Message=Started invocation of ScriptBlock ID: 8de2b9fe-761b-40f2-8543-552cf2a8950e Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113425 Keywords=None Message=Completed invocation of ScriptBlock ID: 637c1ea4-c6fd-4363-8e7d-eecf35e7e971 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113424 Keywords=None Message=Started invocation of ScriptBlock ID: 637c1ea4-c6fd-4363-8e7d-eecf35e7e971 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113423 Keywords=None Message=Completed invocation of ScriptBlock ID: 7a4656d5-3c3d-46e7-925b-371ac6a9da18 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113422 Keywords=None Message=Started invocation of ScriptBlock ID: 7a4656d5-3c3d-46e7-925b-371ac6a9da18 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113421 Keywords=None Message=Completed invocation of ScriptBlock ID: 58929e36-60f5-46ab-89c2-aed474178b8a Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113420 Keywords=None Message=Started invocation of ScriptBlock ID: 58929e36-60f5-46ab-89c2-aed474178b8a Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113419 Keywords=None Message=Completed invocation of ScriptBlock ID: 71389673-5295-47a0-bf5a-b8264426cf25 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113418 Keywords=None Message=Started invocation of ScriptBlock ID: 71389673-5295-47a0-bf5a-b8264426cf25 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113417 Keywords=None Message=Completed invocation of ScriptBlock ID: 526f43ba-f8cd-4b2d-bb78-91d71d64e056 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113416 Keywords=None Message=Started invocation of ScriptBlock ID: 526f43ba-f8cd-4b2d-bb78-91d71d64e056 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113415 Keywords=None Message=Completed invocation of ScriptBlock ID: 21210478-ec62-49a2-947f-94e7966f69c0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113414 Keywords=None Message=Started invocation of ScriptBlock ID: 21210478-ec62-49a2-947f-94e7966f69c0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113413 Keywords=None Message=Completed invocation of ScriptBlock ID: 21210478-ec62-49a2-947f-94e7966f69c0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113412 Keywords=None Message=Started invocation of ScriptBlock ID: 21210478-ec62-49a2-947f-94e7966f69c0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113411 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113410 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113409 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113408 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113407 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113406 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113405 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113404 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113403 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113402 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113401 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113400 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113399 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113398 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113397 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113396 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113395 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113394 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113393 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113392 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113391 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113390 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113389 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113388 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113387 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113386 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113385 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113384 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113383 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113382 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113381 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113380 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113379 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113378 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113377 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113376 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113375 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113374 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113373 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113372 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113371 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113370 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113369 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113368 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113367 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113366 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113365 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113364 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113363 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113362 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113361 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113360 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113359 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113358 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113357 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113356 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113355 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113354 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113353 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113352 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113351 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113350 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113349 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113348 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113347 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113346 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113345 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113344 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113343 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113342 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113341 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113340 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113339 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113338 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113337 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113336 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113335 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113334 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113333 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113332 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113331 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113330 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113329 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113328 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113327 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113326 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113325 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113324 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113323 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113322 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113321 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113320 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113319 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113318 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113317 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113316 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113315 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113314 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113313 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113312 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113311 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113310 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113309 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113308 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113307 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113306 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113305 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113304 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113303 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113302 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113301 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113300 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113299 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113298 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113297 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113296 Keywords=None Message=Started invocation of ScriptBlock ID: 6fd7def3-f2a6-4a78-b6a8-997408e22353 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113295 Keywords=None Message=Completed invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113294 Keywords=None Message=Started invocation of ScriptBlock ID: ffcae7d2-2e42-4d3a-81b3-13352cc3e7e2 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113293 Keywords=None Message=Completed invocation of ScriptBlock ID: ef81029f-b036-483a-9723-9e35fb8fb315 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113292 Keywords=None Message=Started invocation of ScriptBlock ID: ef81029f-b036-483a-9723-9e35fb8fb315 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113291 Keywords=None Message=Completed invocation of ScriptBlock ID: ef81029f-b036-483a-9723-9e35fb8fb315 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113290 Keywords=None Message=Started invocation of ScriptBlock ID: ef81029f-b036-483a-9723-9e35fb8fb315 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113289 Keywords=None Message=Completed invocation of ScriptBlock ID: ef81029f-b036-483a-9723-9e35fb8fb315 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113288 Keywords=None Message=Started invocation of ScriptBlock ID: ef81029f-b036-483a-9723-9e35fb8fb315 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113287 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113286 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113285 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113284 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113283 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113282 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113281 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113280 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113279 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113278 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113277 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113276 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113275 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113274 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113273 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113272 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113271 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113270 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113269 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113268 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113267 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113266 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113265 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113264 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113263 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113262 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113261 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113260 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113259 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113258 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113257 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113256 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113255 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113254 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113253 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113252 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113251 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113250 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113249 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113248 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113247 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113246 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113245 Keywords=None Message=Completed invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113244 Keywords=None Message=Started invocation of ScriptBlock ID: 6df1c4b8-1967-4705-b012-75d1676b6764 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113243 Keywords=None Message=Started invocation of ScriptBlock ID: b7c2ff8e-86b0-49df-9d57-b947cad47888 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=12113242 Keywords=None Message=Creating Scriptblock text (1 of 1): Get-DomainUser -PreauthNotRequired ScriptBlock ID: b7c2ff8e-86b0-49df-9d57-b947cad47888 Path: 02/18/2022 10:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113241 Keywords=None Message=Completed invocation of ScriptBlock ID: 705c35ce-c91d-4aeb-8235-ddbc30dd0a1c Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113518 Keywords=None Message=Started invocation of ScriptBlock ID: 705c35ce-c91d-4aeb-8235-ddbc30dd0a1c Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113517 Keywords=None Message=Completed invocation of ScriptBlock ID: e34e8b6f-5908-4b3e-8ffe-2a3b5adff4f5 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113516 Keywords=None Message=Completed invocation of ScriptBlock ID: b80967b8-c43d-4513-868e-ebed106c0c42 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113515 Keywords=None Message=Started invocation of ScriptBlock ID: b80967b8-c43d-4513-868e-ebed106c0c42 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113514 Keywords=None Message=Started invocation of ScriptBlock ID: e34e8b6f-5908-4b3e-8ffe-2a3b5adff4f5 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=12113513 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: e34e8b6f-5908-4b3e-8ffe-2a3b5adff4f5 Path: 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113512 Keywords=None Message=Completed invocation of ScriptBlock ID: eb66c543-5eae-46cc-a960-5b118c8231b0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113511 Keywords=None Message=Started invocation of ScriptBlock ID: eb66c543-5eae-46cc-a960-5b118c8231b0 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113510 Keywords=None Message=Completed invocation of ScriptBlock ID: 80f637e1-a3c3-4924-bada-d96fc856d8e4 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=12113509 Keywords=None Message=Started invocation of ScriptBlock ID: 80f637e1-a3c3-4924-bada-d96fc856d8e4 Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=12113508 Keywords=None Message=Creating Scriptblock text (1 of 1): .\Rubeus.exe asreproast /format:hashcat /nowrap ScriptBlock ID: 80f637e1-a3c3-4924-bada-d96fc856d8e4 Path: 02/18/2022 10:11:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=12113507 Keywords=None Message=Completed invocation of ScriptBlock ID: 705c35ce-c91d-4aeb-8235-ddbc30dd0a1c Runspace ID: 7827dd4f-865e-4265-b9e7-184dca74469e