<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4103</EventID><Version>1</Version><Level>4</Level><Task>106</Task><Opcode>20</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/><EventRecordID>3885</EventRecordID><Correlation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/><Execution ProcessID='3984' ThreadID='3616'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='ContextInfo'>        Severity = Informational
        Host Name = ServerRemoteHost
        Host Version = 1.0.0.0
        Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e
        Host Application = C:\Windows\system32\wsmprovhost.exe -Embedding
        Engine Version = 5.1.17763.1007
        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e
        Pipeline ID = 1
        Command Name = cmd.exe
        Command Type = Application
        Script Name =
        Command Path = C:\Windows\system32\cmd.exe
        Sequence Number = 34
        User = VAGRANT\vagrant
        Connected User = VAGRANT\vagrant
        Shell ID = Microsoft.PowerShell
</Data><Data Name='UserData'></Data><Data Name='Payload'>CommandInvocation(cmd.exe): "cmd.exe"
CommandInvocation(Out-Null): "Out-Null"
ParameterBinding(Out-Null): name="InputObject"; value="symbolic link created for C:\vagrant &lt;&lt;===&gt;&gt; \\vboxsvr\vagrant"
</Data></EventData></Event>
