0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Function","Started","\tProviderName=Function\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=9\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11278,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260786|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Variable","Started","\tProviderName=Variable\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=11\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11279,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260786|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Available","None","\tNewEngineState=Available\r\n\tPreviousEngineState=None\r\n\r\n\tSequenceNumber=13\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=9e5bfb08-c8c3-4168-a1a3-46bc1f6aed98\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":400,"event_record_id":11280,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260786|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Stopped","Available","\tNewEngineState=Stopped\r\n\tPreviousEngineState=Available\r\n\r\n\tSequenceNumber=15\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=12fb1550-f49d-40b7-87d2-73ddcc759951\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\c84ad3ec-850b-4d5d-a8e3-ccaf990d2e10.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=9e5bfb08-c8c3-4168-a1a3-46bc1f6aed98\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":403,"event_record_id":11281,"provider_name":"PowerShell"}|0||0|0|0|-1|1647260787|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Registry","Started","\tProviderName=Registry\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=1\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11282,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Alias","Started","\tProviderName=Alias\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=3\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11283,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Environment","Started","\tProviderName=Environment\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=5\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11284,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["FileSystem","Started","\tProviderName=FileSystem\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=7\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11285,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Function","Started","\tProviderName=Function\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=9\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11286,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Variable","Started","\tProviderName=Variable\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=11\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11287,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Available","None","\tNewEngineState=Available\r\n\tPreviousEngineState=None\r\n\r\n\tSequenceNumber=13\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=ce9032de-e9c5-46cd-901c-ac7b12ef775f\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":400,"event_record_id":11288,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Stopped","Available","\tNewEngineState=Stopped\r\n\tPreviousEngineState=Available\r\n\r\n\tSequenceNumber=15\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=d6f4e1cd-f910-4cbb-8942-03db9969b70c\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\92002c24-17b2-4a94-9a27-8254b4ace281.ps1'\r\n\tEngineVersion=5.1.19041.1320\r\n\tRunspaceId=ce9032de-e9c5-46cd-901c-ac7b12ef775f\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":403,"event_record_id":11289,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261716|-1|-1
0|{"activity_id":null,"channel_name":"Windows PowerShell","custom_data":{"EventData":{"Binary":null,"Data":{"#text":["Registry","Started","\tProviderName=Registry\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=1\r\n\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.19041.1320\r\n\tHostId=e04060c8-1f2f-4a10-994b-4e3cfbb1c323\r\n\tHostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass & 'C:\\WINDOWS\\CCM\\SystemTemp\\e3428e80-41fb-4a90-a9df-a3bb372c9a0b.ps1'\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="]}}},"event_id":600,"event_record_id":11290,"provider_name":"PowerShell"}|0||0|0|0|-1|1647261717|-1|-1