ElfFilegElfChnkaapvxV#Dl=f?mMF5<&** E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy ** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0 E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a**  E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0 E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0**  E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W **  E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo ** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**( E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25<6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** _ E'b& >V!!# _   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  _ E'b& >V!!# _   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy ** _ E'b& >V!!# _   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** _ E'b& >V!!# _   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** _ E'b& >V!!# _   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** _ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** _ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** _ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(_ E'b& >V!!# _  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**   E'b& >V!!#  <H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!  E'b& >V!!#  <H ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**"  E'b& >V!!#  <H " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**#  E'b& >V!!#  <H # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** $  E'b& >V!!#  <H $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **%  E'b& >V!!#  <H % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**&  E'b& >V!!#  <H & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**'  E'b& >V!!#  <H ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0(  E'b& >V!!#  <H ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**)  E'b& >V!!#  <H ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h***  E'b& >V!!#  <H * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**+  E'b& >V!!#  <H + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**,  E'b& >V!!#  <H , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** -  E'b& >V!!#  <H - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **.  E'b& >V!!#  <H . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**/  E'b& >V!!#  <H / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**0  E'b& >V!!#  <H 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**1  E'b& >V!!#  <H 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(2  E'b& >V!!#  <H 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@3  E'b& >V!!#  <H 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**04  E'b& >V!!#  <H 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** 5  E'b& >V!!#  <H 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** 6  E'b& >V!!#  <H 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **7  E'b& >V!!#  <H 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**8  E'b& >V!!#  <H 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(9  E'b& >V!!#  <H 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** :"6Z E'b& >V!!# "6Z%qLW%qL0: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **;"6Z E'b& >V!!# "6Z%qLW%qL0; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**<"6Z E'b& >V!!# "6Z%qLW%qL0< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**="6Z E'b& >V!!# "6Z%qLW%qL0= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** >"6Z E'b& >V!!# "6Z%qLW%qL0> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **?"6Z E'b& >V!!# "6Z%qLW%qL0? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**@"6Z E'b& >V!!# "6Z%qLW%qL0@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**A"6Z E'b& >V!!# "6Z%qLW%qL0A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0B"6Z E'b& >V!!# "6Z%qLW%qL0B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**C"6Z E'b& >V!!# "6Z%qLW%qL0C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**D"6Z E'b& >V!!# "6Z%qLW%qL0D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**E"6Z E'b& >V!!# "6Z%qLW%qL0E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**F"6Z E'b& >V!!# "6Z%qLW%qL0F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** G"6Z E'b& >V!!# "6Z%qLW%qL0G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **H"6Z E'b& >V!!# "6Z%qLW%qL0H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**I"6Z E'b& >V!!# "6Z%qLW%qL0I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**J"6Z E'b& >V!!# "6Z%qLW%qL0J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**K"6Z E'b& >V!!# "6Z%qLW%qL0K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(L"6Z E'b& >V!!# "6Z%qLW%qL0L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@M"6Z E'b& >V!!# "6Z%qLW%qL0M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0N"6Z E'b& >V!!# "6Z%qLW%qL0N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** O"6Z E'b& >V!!# "6Z%qLW%qL0O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** P"6Z E'b& >V!!# "6Z%qLW%qL0P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **Q"6Z E'b& >V!!# "6Z%qLW%qL0Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**R"6Z E'b& >V!!# "6Z%qLW%qL0R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(S"6Z E'b& >V!!# "6Z%qLW%qL0S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** T6+:Z E'b& >V!!# 6+:Z%qL%qL T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **U6+:Z E'b& >V!!# 6+:Z%qL%qL U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**V6+:Z E'b& >V!!# 6+:Z%qL%qL V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**W6+:Z E'b& >V!!# 6+:Z%qL%qL W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** X6+:Z E'b& >V!!# 6+:Z%qL%qL X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **Y6+:Z E'b& >V!!# 6+:Z%qL%qL Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Z6+:Z E'b& >V!!# 6+:Z%qL%qL Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**[6+:Z E'b& >V!!# 6+:Z%qL%qL [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0\6+:Z E'b& >V!!# 6+:Z%qL%qL \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**]6+:Z E'b& >V!!# 6+:Z%qL%qL ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**^6+:Z E'b& >V!!# 6+:Z%qL%qL ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**_6+:Z E'b& >V!!# 6+:Z%qL%qL _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**`6+:Z E'b& >V!!# 6+:Z%qL%qL ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** a6+:Z E'b& >V!!# 6+:Z%qL%qL a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow owerShell\v1 E'b& >VE'b!# 6+:Z%qL%qL b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkbb`ծoKDl=f?mMF"&**b6+:Z E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# 6+:Z%qL%qL b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**c6+:Z E'b& >V!!# 6+:Z%qL%qL c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**d6+:Z E'b& >V!!# 6+:Z%qL%qL d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**e6+:Z E'b& >V!!# 6+:Z%qL%qL e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(f6+:Z E'b& >V!!# 6+:Z%qL%qL f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@g6+:Z E'b& >V!!# 6+:Z%qL%qL g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0h6+:Z E'b& >V!!# 6+:Z%qL%qL h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** i6+:Z E'b& >V!!# 6+:Z%qL%qL i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** j6+:Z E'b& >V!!# 6+:Z%qL%qL j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **k6+:Z E'b& >V!!# 6+:Z%qL%qL k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**l6+:Z E'b& >V!!# 6+:Z%qL%qL l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(m6+:Z E'b& >V!!# 6+:Z%qL%qL m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@n:Z E'b& >V!!# :Z%qLɀ%qL` n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2"6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**o:Z E'b& >V!!# :Z%qLɀ%qL` o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **p:Z E'b& >V!!# :Z%qLɀ%qL` p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **q:Z E'b& >V!!# :Z%qLɀ%qL` q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** r:Z E'b& >V!!# :Z%qLɀ%qL` r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **s:Z E'b& >V!!# :Z%qLɀ%qL` s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**t:Z E'b& >V!!# :Z%qLɀ%qL` t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**u:Z E'b& >V!!# :Z%qLɀ%qL` u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0v:Z E'b& >V!!# :Z%qLɀ%qL` v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**w:Z E'b& >V!!# :Z%qLɀ%qL` w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**x:Z E'b& >V!!# :Z%qLɀ%qL` x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**y:Z E'b& >V!!# :Z%qLɀ%qL` y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**z:Z E'b& >V!!# :Z%qLɀ%qL` z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** {:Z E'b& >V!!# :Z%qLɀ%qL` { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **|:Z E'b& >V!!# :Z%qLɀ%qL` | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**}:Z E'b& >V!!# :Z%qLɀ%qL` } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**~:Z E'b& >V!!# :Z%qLɀ%qL` ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** :Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** :Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(:Z E'b& >V!!# :Z%qLɀ%qL`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** *ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** *ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0*ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** *ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(*ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@*ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0*ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** *ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** *ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6***ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(*ػ E'b& >V!!# *ػҶ')8(d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678970**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0hlڻ E'b& >V!!# hlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** xlڻ E'b& >V!!# xlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** xlڻ E'b& >V!!# xlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **xlڻ E'b& >V!!# xlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**xlڻ E'b& >V!!# xlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(xlڻ E'b& >V!!# xlڻҶ'(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** %ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** %ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789Q0**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** %ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** %ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** %ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(%ۻ E'b& >V!!# %ۻҶ'x8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkIIpfGDl=f?mMF& ** Yp E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿W0$DD EventDataA=loData= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe**( Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . .Ŀ[9TDA)l= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r(** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,r**  Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0?w ** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0I** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $c**0 Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ft-W0** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-W** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2W** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .c** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,W**  Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow ** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**( Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0 Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0**  Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. **  Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe ** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( Yp E'b& >V!!#  Yp%E:pE:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**up E'b& >V!!# up%E:E: P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( up E'b& >V!!# up%E:E: P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  @p E'b& >V!!# @p%E:[pE:H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** @p E'b& >V!!# @p%E:[pE:H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** @p E'b& >V!!# @p%E:[pE:H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** @p E'b& >V!!# @p%E:[pE:H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** @p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** @p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0@p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** @p E'b& >V!!# @p%E:[pE:H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. **  @p E'b& >V!!# @p%E:[pE:H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **!@p E'b& >V!!# @p%E:[pE:H! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**"@p E'b& >V!!# @p%E:[pE:H" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(#@p E'b& >V!!# @p%E:[pE:H# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** $(˜ E'b& >V!!# (˜ƕƕP $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **%(˜ E'b& >V!!# (˜ƕƕP % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**&(˜ E'b& >V!!# (˜ƕƕP & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**'(˜ E'b& >V!!# (˜ƕƕP ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ((˜ E'b& >V!!# (˜ƕƕP ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **)(˜ E'b& >V!!# (˜ƕƕP ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***(˜ E'b& >V!!# (˜ƕƕP * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**+(˜ E'b& >V!!# (˜ƕƕP + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0,(˜ E'b& >V!!# (˜ƕƕP , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**-(˜ E'b& >V!!# (˜ƕƕP - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**.(˜ E'b& >V!!# (˜ƕƕP . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**/(˜ E'b& >V!!# (˜ƕƕP / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**0(˜ E'b& >V!!# (˜ƕƕP 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** 1(˜ E'b& >V!!# (˜ƕƕP 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **2(˜ E'b& >V!!# (˜ƕƕP 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**3(˜ E'b& >V!!# (˜ƕƕP 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**4(˜ E'b& >V!!# (˜ƕƕP 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**5(˜ E'b& >V!!# (˜ƕƕP 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(6(˜ E'b& >V!!# (˜ƕƕP 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@7(˜ E'b& >V!!# (˜ƕƕP 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&PC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**08(˜ E'b& >V!!# (˜ƕƕP 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** 9(˜ E'b& >V!!# (˜ƕƕP 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** :(˜ E'b& >V!!# (˜ƕƕP : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **;(˜ E'b& >V!!# (˜ƕƕP ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**<(˜ E'b& >V!!# (˜ƕƕP < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(=(˜ E'b& >V!!# (˜ƕƕP = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** >C E'b& >V!!# CƕĐƕx\> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USxC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **?C E'b& >V!!# CƕĐƕx\? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**@C E'b& >V!!# CƕĐƕx\@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**AC E'b& >V!!# CƕĐƕx\A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** BC E'b& >V!!# CƕĐƕx\B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **CC E'b& >V!!# CƕĐƕx\C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**DC E'b& >V!!# CƕĐƕx\D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**EC E'b& >V!!# CƕĐƕx\E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0FC E'b& >V!!# CƕĐƕx\F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**GC E'b& >V!!# CƕĐƕx\G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**HC E'b& >V!!# CƕĐƕx\H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**IC E'b& >V!!# CƕĐƕx\I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .hl\v1.0\power E'b& >VE'b!# CƕĐƕx\J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkJJ<< ,ODl=f?mMF%'&**JC E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# CƕĐƕx\J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l.** KC E'b& >V!!# CƕĐƕx\K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0l **LC E'b& >V!!# CƕĐƕx\L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1i**MC E'b& >V!!# CƕĐƕx\M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+i**NC E'b& >V!!# CƕĐƕx\N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /i**OC E'b& >V!!# CƕĐƕx\O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :r**(PC E'b& >V!!# CƕĐƕx\P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyal(**@QC E'b& >V!!# CƕĐƕx\Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&xC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyt-Wi@**0RC E'b& >V!!# CƕĐƕx\R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tttern0** SC E'b& >V!!# CƕĐƕx\S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMndow ** TC E'b& >V!!# CƕĐƕx\T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMs-In **UC E'b& >V!!# CƕĐƕx\U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6n**VC E'b& >V!!# CƕĐƕx\V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0n**(WC E'b& >V!!# CƕĐƕx\W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyo(**@X E'b& >V!!# ƕϐƕ4X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%'6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**Y E'b& >V!!# ƕϐƕ4Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Z E'b& >V!!# ƕϐƕ4Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**[ E'b& >V!!# ƕϐƕ4[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** \ E'b& >V!!# ƕϐƕ4\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **] E'b& >V!!# ƕϐƕ4] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**^ E'b& >V!!# ƕϐƕ4^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**_ E'b& >V!!# ƕϐƕ4_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0` E'b& >V!!# ƕϐƕ4` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789 Y0**a E'b& >V!!# ƕϐƕ4a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**b E'b& >V!!# ƕϐƕ4b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**c E'b& >V!!# ƕϐƕ4c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**d E'b& >V!!# ƕϐƕ4d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** e E'b& >V!!# ƕϐƕ4e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **f E'b& >V!!# ƕϐƕ4f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**g E'b& >V!!# ƕϐƕ4g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**h E'b& >V!!# ƕϐƕ4h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**i E'b& >V!!# ƕϐƕ4i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(j E'b& >V!!# ƕϐƕ4j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@kC E'b& >V!!# Cƕϐƕ4k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0lC E'b& >V!!# Cƕϐƕ4l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** mC E'b& >V!!# Cƕϐƕ4m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** nC E'b& >V!!# Cƕϐƕ4n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **oC E'b& >V!!# Cƕϐƕ4o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**pC E'b& >V!!# Cƕϐƕ4p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(qC E'b& >V!!# Cƕϐƕ4q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** r0G}7 E'b& >V!!# 0G}7xvzE{E t r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **s0G}7 E'b& >V!!# 0G}7xvzE{E t s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**t0G}7 E'b& >V!!# 0G}7xvzE{E t t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**u0G}7 E'b& >V!!# 0G}7xvzE{E t u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** v0G}7 E'b& >V!!# 0G}7xvzE{E t v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **w0G}7 E'b& >V!!# 0G}7xvzE{E t w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**x0G}7 E'b& >V!!# 0G}7xvzE{E t x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**y0G}7 E'b& >V!!# 0G}7xvzE{E t y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0z0G}7 E'b& >V!!# 0G}7xvzE{E t z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789u0**{0G}7 E'b& >V!!# 0G}7xvzE{E t { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**|0G}7 E'b& >V!!# 0G}7xvzE{E t | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**}0G}7 E'b& >V!!# 0G}7xvzE{E t } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**~0G}7 E'b& >V!!# 0G}7xvzE{E t ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**00G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(0G}7 E'b& >V!!# 0G}7xvzE{E t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-USd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789@0** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&d C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( €7 E'b& >V!!#  €7xvzE7{Ed 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-USdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789(˜0**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&dC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnk11eZs.VDl=f?mMF &**P7 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0l.**(P7 E'b& >V!!# P7xvzE;{Ed ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** |u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** |u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** |u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** |u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(|u E'b& >V!!# |ujMLNL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** + E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** + E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** + E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&p C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** + E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** + E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(+ E'b& >V!!# +jML3NLp X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&HC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670**  a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q **  a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 ** a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( a E'b& >V!!# ajMLNLHD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** p E'b& >V!!# pj\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **p E'b& >V!!# pj\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**p E'b& >V!!# pj\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**p E'b& >V!!# pj\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** p E'b& >V!!# pj\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **p E'b& >V!!# pj\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0 E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w**  E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh ** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h** E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(  E'b& >V!!# j\CL\C<  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@! E'b& >V!!# j\CL\C< ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0" E'b& >V!!# j\CL\C< " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** # E'b& >V!!# j\CL\C< # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** $ E'b& >V!!# j\CL\C< $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **% E'b& >V!!# j\CL\C< % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**& E'b& >V!!# j\CL\C< & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(' E'b& >V!!# j\CL\C< ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** (* E'b& >V!!# *j\CZ\Cx( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USxC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **)Q E'b& >V!!# Qj\CZ\Cx) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2***Q E'b& >V!!# Qj\CZ\Cx* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**+Q E'b& >V!!# Qj\CZ\Cx+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ,Q E'b& >V!!# Qj\CZ\Cx, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **-Q E'b& >V!!# Qj\CZ\Cx- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**.Q E'b& >V!!# Qj\CZ\Cx. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**/Q E'b& >V!!# Qj\CZ\Cx/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**00Q E'b& >V!!# Qj\CZ\Cx0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**1Q E'b& >V!!# Qj\CZ\Cx1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0owershell.ex E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnk22~ŤoDl=f?mMFU+&**2Q E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# Qj\CZ\Cx2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2l.**3Q E'b& >V!!# Qj\CZ\Cx3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**4Q E'b& >V!!# Qj\CZ\Cx4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 5Q E'b& >V!!# Qj\CZ\Cx5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **6Q E'b& >V!!# Qj\CZ\Cx6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**7Q E'b& >V!!# Qj\CZ\Cx7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**8Q E'b& >V!!# Qj\CZ\Cx8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**9Q E'b& >V!!# Qj\CZ\Cx9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(:Q E'b& >V!!# Qj\CZ\Cx: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@;Q E'b& >V!!# Qj\CZ\Cx; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&xC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0<Q E'b& >V!!# Qj\CZ\Cx< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** =Q E'b& >V!!# Qj\CZ\Cx= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** >Q E'b& >V!!# Qj\CZ\Cx> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **?Q E'b& >V!!# Qj\CZ\Cx? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**@Q E'b& >V!!# Qj\CZ\Cx@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(AQ E'b& >V!!# Qj\CZ\CxA ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@B(  E'b& >V!!# ( j\Ch\CHXB ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**C,  E'b& >V!!# , j\Ch\CHXC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**D,  E'b& >V!!# , j\Ch\CHXD ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**E,  E'b& >V!!# , j\Ch\CHXE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** F,  E'b& >V!!# , j\Ch\CHXF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **G,  E'b& >V!!# , j\Ch\CHXG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**H,  E'b& >V!!# , j\Ch\CHXH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**I,  E'b& >V!!# , j\Ch\CHXI ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0J,  E'b& >V!!# , j\Ch\CHXJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**K,  E'b& >V!!# , j\Ch\CHXK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**L,  E'b& >V!!# , j\Ch\CHXL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**M,  E'b& >V!!# , j\Ch\CHXM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**N,  E'b& >V!!# , j\Ch\CHXN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** O,  E'b& >V!!# , j\Ch\CHXO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **P,  E'b& >V!!# , j\Ch\CHXP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Q,  E'b& >V!!# , j\Ch\CHXQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**R,  E'b& >V!!# , j\Ch\CHXR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**S,  E'b& >V!!# , j\Ch\CHXS ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(T,  E'b& >V!!# , j\Ch\CHXT ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@U,  E'b& >V!!# , j\Ch\CHXU ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&HC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0V,  E'b& >V!!# , j\Ch\CHXV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** W,  E'b& >V!!# , j\Ch\CHXW ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** X,  E'b& >V!!# , j\Ch\CHXX ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Y,  E'b& >V!!# , j\Ch\CHXY ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Z,  E'b& >V!!# , j\Ch\CHXZ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**([,  E'b& >V!!# , j\Ch\CHX[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** \AI E'b& >V!!# AI\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]AI E'b& >V!!# AI] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**^AI E'b& >V!!# AI^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**_AI E'b& >V!!# AI_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** `AI E'b& >V!!# AI` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **aAI E'b& >V!!# AIa ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**bAI E'b& >V!!# AIb ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**cAI E'b& >V!!# AIc ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0dAI E'b& >V!!# AId ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**eAI E'b& >V!!# AIe ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**fAI E'b& >V!!# AIf ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**gAI E'b& >V!!# AIg ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**hAI E'b& >V!!# AIh ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** iAI E'b& >V!!# AIi ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **jAI E'b& >V!!# AIj ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**kAI E'b& >V!!# AIk ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**lAI E'b& >V!!# AIl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**mAI E'b& >V!!# AIm ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(nX@I E'b& >V!!# X@In ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@oX@I E'b& >V!!# X@Io ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0pX@I E'b& >V!!# X@Ip ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** qX@I E'b& >V!!# X@Iq ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** rX@I E'b& >V!!# X@Ir ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **sX@I E'b& >V!!# X@Is ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**tX@I E'b& >V!!# X@It ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(uX@I E'b& >V!!# X@Iu ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** vĝI E'b& >V!!# ĝI,J $ v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **wĝI E'b& >V!!# ĝI,J $ w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**xĝI E'b& >V!!# ĝI,J $ x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**yĝI E'b& >V!!# ĝI,J $ y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** zĝI E'b& >V!!# ĝI,J $ z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **{ĝI E'b& >V!!# ĝI,J $ { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**|ĝI E'b& >V!!# ĝI,J $ | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**}ĝI E'b& >V!!# ĝI,J $ } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0~ĝI E'b& >V!!# ĝI,J $ ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b&  E'b& >VV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkV!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM.**cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(s E'b& >V!!# sZA_A(A_\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** _ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** _ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** _ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** _ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** _ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(_ E'b& >V!!# _ZA_K(A_ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** } E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** } E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** } E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** } E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** } E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(} E'b& >V!!# }ZA_W(A_  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(ĝI E'b& >V!!# ĝI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ēI E'b& >V!!# ēI,J $  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** cEI E'b& >V!!# cEI9J  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b&  E'b& >VV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkMMj9ҰDl=f?mMF &**ca- E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ca-mƙ4 < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0l.**(ca- E'b& >V!!# ca-mƙ4 < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** $l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** $l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**($l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** $l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** $l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**$l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**($l- E'b& >V!!# $l-ms  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M** E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h** E'b& >V!!# O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0* E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** * E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh *** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(* E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ * E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0 * E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670**  * E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q **  * E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 ** * E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6*** E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(* E'b& >V!!# *O{K9{K@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0 E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0** E'b& >V!!# O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**< E'b& >V!!# <O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**< E'b& >V!!# <O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**< E'b& >V!!# <O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** < E'b& >V!!# <O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **< E'b& >V!!# <O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**< E'b& >V!!# <O{KC9{K  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** < E'b& >V!!# <O{KC9{K   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**!< E'b& >V!!# <O{KC9{K ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**("< E'b& >V!!# <O{KC9{K " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@#< E'b& >V!!# <O{KC9{K # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0$< E'b& >V!!# <O{KC9{K $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** %< E'b& >V!!# <O{KC9{K % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** &< E'b& >V!!# <O{KC9{K & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **'< E'b& >V!!# <O{KC9{K ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**(< E'b& >V!!# <O{KC9{K ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**()< E'b& >V!!# <O{KC9{K ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** * C E'b& >V!!#  CO{KS9{K40 * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **+ C E'b& >V!!#  CO{KS9{K40 + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**, C E'b& >V!!#  CO{KS9{K40 , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**- C E'b& >V!!#  CO{KS9{K40 - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** . C E'b& >V!!#  CO{KS9{K40 . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **/ C E'b& >V!!#  CO{KS9{K40 / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**0 C E'b& >V!!#  CO{KS9{K40 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**1 C E'b& >V!!#  CO{KS9{K40 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**02 C E'b& >V!!#  CO{KS9{K40 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**39j E'b& >V!!# 9jO{KS9{K40 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**49j E'b& >V!!# 9jO{KS9{K40 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**59j E'b& >V!!# 9jO{KS9{K40 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**69j E'b& >V!!# 9jO{KS9{K40 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** 79j E'b& >V!!# 9jO{KS9{K40 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **89j E'b& >V!!# 9jO{KS9{K40 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**99j E'b& >V!!# 9jO{KS9{K40 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**:9j E'b& >V!!# 9jO{KS9{K40 : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**;9j E'b& >V!!# 9jO{KS9{K40 ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(<9j E'b& >V!!# 9jO{KS9{K40 < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@=9j E'b& >V!!# 9jO{KS9{K40 = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0>9j E'b& >V!!# 9jO{KS9{K40 > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ?9j E'b& >V!!# 9jO{KS9{K40 ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** @9j E'b& >V!!# 9jO{KS9{K40 @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **A9j E'b& >V!!# 9jO{KS9{K40 A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**B9j E'b& >V!!# 9jO{KS9{K40 B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(C9j E'b& >V!!# 9jO{KS9{K40 C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** D E'b& >V!!# CnhnD ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **E E'b& >V!!# CnhnE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**F E'b& >V!!# CnhnF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**G E'b& >V!!# CnhnG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** H E'b& >V!!# CnhnH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **I E'b& >V!!# CnhnI ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**J E'b& >V!!# CnhnJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**K E'b& >V!!# CnhnK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0L E'b& >V!!# CnhnL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**M E'b& >V!!# CnhnM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0owershell.ex E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkNN΃1oDl=f?mMFU+&**N E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# CnhnN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2l.**O E'b& >V!!# CnhnO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**P E'b& >V!!# CnhnP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Q E'b& >V!!# CnhnQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **R E'b& >V!!# CnhnR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**S E'b& >V!!# CnhnS ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**T E'b& >V!!# CnhnT ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**U E'b& >V!!# CnhnU ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(V E'b& >V!!# CnhnV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@W E'b& >V!!# CnhnW ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0X  E'b& >V!!#  CnhnX ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** Y  E'b& >V!!#  CnhnY ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** Z  E'b& >V!!#  CnhnZ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **[  E'b& >V!!#  Cnhn[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**\  E'b& >V!!#  Cnhn\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(]  E'b& >V!!#  Cnhn] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@^qf E'b& >V!!# qfCnJn\^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**_q)f E'b& >V!!# q)fCnJn\_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**`q)f E'b& >V!!# q)fCnJn\` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**aq)f E'b& >V!!# q)fCnJn\a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** bq)f E'b& >V!!# q)fCnJn\b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **cq)f E'b& >V!!# q)fCnJn\c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**dq)f E'b& >V!!# q)fCnJn\d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**eq)f E'b& >V!!# q)fCnJn\e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0fq)f E'b& >V!!# q)fCnJn\f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**gq)f E'b& >V!!# q)fCnJn\g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**hq)f E'b& >V!!# q)fCnJn\h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**iq)f E'b& >V!!# q)fCnJn\i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**jq)f E'b& >V!!# q)fCnJn\j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** kq)f E'b& >V!!# q)fCnJn\k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **lq)f E'b& >V!!# q)fCnJn\l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**mq)f E'b& >V!!# q)fCnJn\m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**nq)f E'b& >V!!# q)fCnJn\n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**oq)f E'b& >V!!# q)fCnJn\o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(pq)f E'b& >V!!# q)fCnJn\p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@qq)f E'b& >V!!# q)fCnJn\q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0rq)f E'b& >V!!# q)fCnJn\r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** sq)f E'b& >V!!# q)fCnJn\s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** tq)f E'b& >V!!# q)fCnJn\t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **uq)f E'b& >V!!# q)fCnJn\u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**vq)f E'b& >V!!# q)fCnJn\v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(wq)f E'b& >V!!# q)fCnJn\w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** x# E'b& >V!!# #CnJnx ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **y# E'b& >V!!# #CnJny ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**z# E'b& >V!!# #CnJnz ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**{# E'b& >V!!# #CnJn{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** |# E'b& >V!!# #CnJn| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **}# E'b& >V!!# #CnJn} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**~# E'b& >V!!# #CnJn~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**# E'b& >V!!# #CnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(J E'b& >V!!# JCnJn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**zG\^@ E'b& >V!!# zG\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**n\^@ E'b& >V!!# n\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **̕\^@ E'b& >V!!# ̕\^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** \^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** \^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(\^@ E'b& >V!!# \^@AzAz , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(iy`@ E'b& >V!!# iy`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@u`@ E'b& >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0u`@ E'b& >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** u`@ E'b& >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b&  E'b& >VV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnk55pVS Dl=f?mMF&**u`@ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM.**u`@ E'b& >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**u`@ E'b& >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(u`@ E'b& >V!!# u`@AzAz  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@ja@ E'b& >V!!# ja@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&DC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ka@ E'b& >V!!# ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **@ka@ E'b& >V!!# @ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**@ka@ E'b& >V!!# @ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(@ka@ E'b& >V!!# @ka@AzaAzD  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(;$ E'b& >V!!# ;$]w]  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 3! E'b& >V!!# 3!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **3! E'b& >V!!# 3!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**( ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&PC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(ӕ! E'b& >V!!# ӕ!]]P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tPC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**B" E'b& >V!!# B"]]| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0** B" E'b& >V!!# B"]]|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** !B" E'b& >V!!# B"]]|! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **"B" E'b& >V!!# B"]]|" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**#B" E'b& >V!!# B"]]|# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**$B" E'b& >V!!# B"]]|$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**%B" E'b& >V!!# B"]]|% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(&B" E'b& >V!!# B"]]|& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@'B" E'b& >V!!# B"]]|' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0(B" E'b& >V!!# B"]]|( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** )B" E'b& >V!!# B"]]|) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** *B" E'b& >V!!# B"]]|* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **+B" E'b& >V!!# B"]]|+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**,B" E'b& >V!!# B"]]|, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(-B" E'b& >V!!# B"]]|- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** .-*` E'b& >V!!# -*`\TyYTyT . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **/-*` E'b& >V!!# -*`\TyYTyT / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**0-*` E'b& >V!!# -*`\TyYTyT 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**1-*` E'b& >V!!# -*`\TyYTyT 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 2-*` E'b& >V!!# -*`\TyYTyT 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **3-*` E'b& >V!!# -*`\TyYTyT 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**4-*` E'b& >V!!# -*`\TyYTyT 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**5-*` E'b& >V!!# -*`\TyYTyT 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\.0\powershel E'b& >V!# -*`\TyYTyT 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk66x#?C~Dl=f?mMF/&**6-*` E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# -*`\TyYTyT 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789**7-*` E'b& >V!!# -*`\TyYTyT 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**8-*` E'b& >V!!# -*`\TyYTyT 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**9-*` E'b& >V!!# -*`\TyYTyT 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**:-*` E'b& >V!!# -*`\TyYTyT : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** ;-*` E'b& >V!!# -*`\TyYTyT ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ter **<-*` E'b& >V!!# -*`\TyYTyT < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1r**=-*` E'b& >V!!# -*`\TyYTyT = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+r**>-*` E'b& >V!!# -*`\TyYTyT > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /r**?-*` E'b& >V!!# -*`\TyYTyT ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :I**(@-*` E'b& >V!!# -*`\TyYTyT @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyti(**@A-*` E'b& >V!!# -*`\TyYTyT A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyosof@**0B-*` E'b& >V!!# -*`\TyYTyT B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tts-In0** C-*` E'b& >V!!# -*`\TyYTyT C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMt-Wi ** D-*` E'b& >V!!# -*`\TyYTyT D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMndow **E-*` E'b& >V!!# -*`\TyYTyT E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6w**F-*` E'b& >V!!# -*`\TyYTyT F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0w**(G-*` E'b& >V!!# -*`\TyYTyT G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyn(**@Hl3c E'b& >V!!# l3c\TyqTy 8H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**I35c E'b& >V!!# 35c\TyqTy 8I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**J35c E'b& >V!!# 35c\TyqTy 8J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**K35c E'b& >V!!# 35c\TyqTy 8K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** L35c E'b& >V!!# 35c\TyqTy 8L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **M35c E'b& >V!!# 35c\TyqTy 8M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**N35c E'b& >V!!# 35c\TyqTy 8N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O35c E'b& >V!!# 35c\TyqTy 8O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0P35c E'b& >V!!# 35c\TyqTy 8P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**Q35c E'b& >V!!# 35c\TyqTy 8Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**R35c E'b& >V!!# 35c\TyqTy 8R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**S35c E'b& >V!!# 35c\TyqTy 8S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**T35c E'b& >V!!# 35c\TyqTy 8T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** U35c E'b& >V!!# 35c\TyqTy 8U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **V35c E'b& >V!!# 35c\TyqTy 8V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**W35c E'b& >V!!# 35c\TyqTy 8W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**X35c E'b& >V!!# 35c\TyqTy 8X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Y35c E'b& >V!!# 35c\TyqTy 8Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Z35c E'b& >V!!# 35c\TyqTy 8Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@[35c E'b& >V!!# 35c\TyqTy 8[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0\35c E'b& >V!!# 35c\TyqTy 8\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ]35c E'b& >V!!# 35c\TyqTy 8] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ^35c E'b& >V!!# 35c\TyqTy 8^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **_35c E'b& >V!!# 35c\TyqTy 8_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**`35c E'b& >V!!# 35c\TyqTy 8` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(a35c E'b& >V!!# 35c\TyqTy 8a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** bV!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# V!!# OR'p/}s/ H| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **}OR E'b& >V!!# OR'p/}s/ H} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**~OR E'b& >V!!# OR'p/}s/ H~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(OR E'b& >V!!# OR'p/}s/ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-US,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789+0**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@ E'b& >VT 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnka6Dl=f?mMF&**wR E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt** wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM9 **wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(wR E'b& >V!!# wR'p/s/,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy`(**@&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exes-In@**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2n**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .n**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,n** &HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0r**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $I**0&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789nati0**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .I**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l** &HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** &HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** &HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMS **&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(&HdR E'b& >V!!# &HdR'p/I/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyc(** g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;035c **g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMm **g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(g E'b& >V!!# gwpwp <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyc(** J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-UStC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(J̳ E'b& >V!!# J̳wpwpt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0O **߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** ߃ E'b& >V!!# ߃wpwp$   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h** ߃ E'b& >V!!# ߃wpwp$   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**  ߃ E'b& >V!!# ߃wpwp$   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 ** ߃ E'b& >V!!# ߃wpwp$   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10** ߃ E'b& >V!!# ߃wpwp$   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt+0** ߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** ߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(߃ E'b& >V!!# ߃wpwp$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0w **M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y@ E'b& >V>VT 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkp/283Dl=f?mMF3&**M E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0m:**M E'b& >V!!# Mtt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 M E'b& >V!!# Mtt  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**!M E'b& >V!!# Mtt! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**"M E'b& >V!!# Mtt" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**#M E'b& >V!!# Mtt# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**$M E'b& >V!!# Mtt$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** %M E'b& >V!!# Mtt% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0t-W **&M E'b& >V!!# Mtt& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1W**'M E'b& >V!!# Mtt' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+W**(M E'b& >V!!# Mtt( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /W**)M E'b& >V!!# Mtt) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :o**(*M E'b& >V!!# Mtt* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyydo(**@+M E'b& >V!!# Mtt+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy+:Wc@**0,M E'b& >V!!# Mtt, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttosof0** -M E'b& >V!!# Mtt- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM.?w ** .M E'b& >V!!# Mtt. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMMicr **/M E'b& >V!!# Mtt/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6r**0M E'b& >V!!# Mtt0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0r**(1M E'b& >V!!# Mtt1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyi(**@2o$ E'b& >V!!# o$tt0 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ236Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**3o$ E'b& >V!!# o$tt0 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**4o$ E'b& >V!!# o$tt0 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**5o$ E'b& >V!!# o$tt0 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 6o$ E'b& >V!!# o$tt0 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **7o$ E'b& >V!!# o$tt0 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**8o$ E'b& >V!!# o$tt0 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **9o$ E'b& >V!!# o$tt0 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0:o$ E'b& >V!!# o$tt0 : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**;o$ E'b& >V!!# o$tt0 ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**<o$ E'b& >V!!# o$tt0 < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**=o$ E'b& >V!!# o$tt0 = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**>o$ E'b& >V!!# o$tt0 > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ?o$ E'b& >V!!# o$tt0 ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **@o$ E'b& >V!!# o$tt0 @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**Ao$ E'b& >V!!# o$tt0 A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**Bo$ E'b& >V!!# o$tt0 B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**Co$ E'b& >V!!# o$tt0 C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(Do$ E'b& >V!!# o$tt0 D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@Eo$ E'b& >V!!# o$tt0 E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyg@**0Fo$ E'b& >V!!# o$tt0 F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttg0** Go$ E'b& >V!!# o$tt0 G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** Ho$ E'b& >V!!# o$tt0 H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **Io$ E'b& >V!!# o$tt0 I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Jo$ E'b& >V!!# o$tt0 J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Ko$ E'b& >V!!# o$tt0 K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** LT E'b& >V!!# Ttt,l L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-US,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **MT E'b& >V!!# Ttt,l M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**NT E'b& >V!!# Ttt,l N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**OT E'b& >V!!# Ttt,l O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** PT E'b& >V!!# Ttt,l P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **QT E'b& >V!!# Ttt,l Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**RT E'b& >V!!# Ttt,l R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **ST E'b& >V!!# Ttt,l S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0TT E'b& >V!!# Ttt,l T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**UT E'b& >V!!# Ttt,l U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**VT E'b& >V!!# Ttt,l V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**WT E'b& >V!!# Ttt,l W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**XT E'b& >V!!# Ttt,l X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** YT E'b& >V!!# Ttt,l Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **ZT E'b& >V!!# Ttt,l Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**[T E'b& >V!!# Ttt,l [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**\T E'b& >V!!# Ttt,l \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**]T E'b& >V!!# Ttt,l ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(^T E'b& >V!!# Ttt,l ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@_T E'b& >V!!# Ttt,l _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyJ̳@**0`T E'b& >V!!# Ttt,l ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttJ̳0** aT E'b& >V!!# Ttt,l a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** bT E'b& >V!!# Ttt,l b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **cT E'b& >V!!# Ttt,l c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**dT E'b& >V!!# Ttt,l d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(eT E'b& >V!!# Ttt,l e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** fB0e E'b& >V!!# B0eu'B7u'D @f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-USD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **gB0e E'b& >V!!# B0eu'B7u'D @g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hB0e E'b& >V!!# B0eu'B7u'D @h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**iB0e E'b& >V!!# B0eu'B7u'D @i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** jB0e E'b& >V!!# B0eu'B7u'D @j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **kB0e E'b& >V!!# B0eu'B7u'D @k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**lB0e E'b& >V!!# B0eu'B7u'D @l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **mB0e E'b& >V!!# B0eu'B7u'D @m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0nu0e E'b& >V!!# u0eu'B7u'D @n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**ou0e E'b& >V!!# u0eu'B7u'D @o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**pu0e E'b& >V!!# u0eu'B7u'D @p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**qu0e E'b& >V!!# u0eu'B7u'D @q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ru0e E'b& >V!!# u0eu'B7u'D @r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** su0e E'b& >V!!# u0eu'B7u'D @s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **tu0e E'b& >V!!# u0eu'B7u'D @t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**uu0e E'b& >V!!# u0eu'B7u'D @u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**vu0e E'b& >V!!# u0eu'B7u'D @v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**wu0e E'b& >V!!# u0eu'B7u'D @w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(xu0e E'b& >V!!# u0eu'B7u'D @x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@yu0e E'b& >V!!# u0eu'B7u'D @y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&D C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy߃@**0zu0e E'b& >V!!# u0eu'B7u'D @z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt߃0** {u0e E'b& >V!!# u0eu'B7u'D @{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** |u0e E'b& >V!!# u0eu'B7u'D @| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **}u0e E'b& >V!!# u0eu'B7u'D @} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**~u0e E'b& >V!!# u0eu'B7u'D @~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(u0e E'b& >V!!# u0eu'B7u'D @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tD C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :hl.exe 0 E'b& >V!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnko$Dl=f?mMF&**ҡC2e E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy**@ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ҡC2e E'b& >V!!# ҡC2eu' u'  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.@**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0al **2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $f**02e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ndow0**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .f**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**02e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(2e E'b& >V!!# 2eu'* u'X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789o$0** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( E'b& >V!!# ^M Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**   E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789T0**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**   E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **   E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(  E'b& >V!!#  ^M/Q  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**   E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789u00**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**   E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **   E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(  E'b& >V!!#  ^Mz(@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,>V E'b& >VMicrosoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkyyxoϠDl=f?mMF8&**k^ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0 k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(k^ E'b& >V!!# k^ t t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@q` E'b& >V!!# q` tD2t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ286Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**q` E'b& >V!!# q` tD2t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**q` E'b& >V!!# q` tD2t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**q` E'b& >V!!# q` tD2t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  q` E'b& >V!!# q` tD2t  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **!q` E'b& >V!!# q` tD2t ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**"q` E'b& >V!!# q` tD2t " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**#q` E'b& >V!!# q` tD2t # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0$q` E'b& >V!!# q` tD2t $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**%q` E'b& >V!!# q` tD2t % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**&q` E'b& >V!!# q` tD2t & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**'q` E'b& >V!!# q` tD2t ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**(q` E'b& >V!!# q` tD2t ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** )q` E'b& >V!!# q` tD2t ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow ***q` E'b& >V!!# q` tD2t * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**+q` E'b& >V!!# q` tD2t + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**,q` E'b& >V!!# q` tD2t , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**-q` E'b& >V!!# q` tD2t - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(.q` E'b& >V!!# q` tD2t . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@/q` E'b& >V!!# q` tD2t / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**00q` E'b& >V!!# q` tD2t 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** 1q` E'b& >V!!# q` tD2t 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** 2q` E'b& >V!!# q` tD2t 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **3q` E'b& >V!!# q` tD2t 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**4q` E'b& >V!!# q` tD2t 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(5q` E'b& >V!!# q` tD2t 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 6Ua E'b& >V!!# Ua tY2t 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **7Ua E'b& >V!!# Ua tY2t 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**8Ua E'b& >V!!# Ua tY2t 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**9Ua E'b& >V!!# Ua tY2t 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** :Ua E'b& >V!!# Ua tY2t : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **;Ua E'b& >V!!# Ua tY2t ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**<Ua E'b& >V!!# Ua tY2t < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**=Ua E'b& >V!!# Ua tY2t = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0>Ua E'b& >V!!# Ua tY2t > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**?Ua E'b& >V!!# Ua tY2t ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**@Ua E'b& >V!!# Ua tY2t @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**AUa E'b& >V!!# Ua tY2t A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**BUa E'b& >V!!# Ua tY2t B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** CUa E'b& >V!!# Ua tY2t C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **DUa E'b& >V!!# Ua tY2t D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**EUa E'b& >V!!# Ua tY2t E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**FUa E'b& >V!!# Ua tY2t F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**GUa E'b& >V!!# Ua tY2t G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(HUa E'b& >V!!# Ua tY2t H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@IUa E'b& >V!!# Ua tY2t I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0JUa E'b& >V!!# Ua tY2t J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** KUa E'b& >V!!# Ua tY2t K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** LUa E'b& >V!!# Ua tY2t L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **MUa E'b& >V!!# Ua tY2t M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**NUa E'b& >V!!# Ua tY2t N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(OUa E'b& >V!!# Ua tY2t O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** Pw E'b& >V!!# w9K9P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **Qw E'b& >V!!# w9K9Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Rw E'b& >V!!# w9K9R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Sw E'b& >V!!# w9K9S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Tw E'b& >V!!# w9K9T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **Uw E'b& >V!!# w9K9U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Vw E'b& >V!!# w9K9V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**Ww E'b& >V!!# w9K9W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0Xw E'b& >V!!# w9K9X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**Yw E'b& >V!!# w9K9Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**Zw E'b& >V!!# w9K9Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**[w E'b& >V!!# w9K9[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**\w E'b& >V!!# w9K9\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** ]w E'b& >V!!# w9K9] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **^w E'b& >V!!# w9K9^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**_w E'b& >V!!# w9K9_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**`w E'b& >V!!# w9K9` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**aw E'b& >V!!# w9K9a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(bw E'b& >V!!# w9K9b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@cw E'b& >V!!# w9K9c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0dw E'b& >V!!# w9K9d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** ew E'b& >V!!# w9K9e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** fw E'b& >V!!# w9K9f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **gw E'b& >V!!# w9K9g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**h w E'b& >V!!#  w9K9h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(i w E'b& >V!!#  w9K9i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** j,#w E'b& >V!!# ,#w9 9@j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **k,#w E'b& >V!!# ,#w9 9@k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**l,#w E'b& >V!!# ,#w9 9@l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**m,#w E'b& >V!!# ,#w9 9@m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** n,#w E'b& >V!!# ,#w9 9@n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **o,#w E'b& >V!!# ,#w9 9@o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**p,#w E'b& >V!!# ,#w9 9@p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**q,#w E'b& >V!!# ,#w9 9@q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0r,#w E'b& >V!!# ,#w9 9@r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**s,#w E'b& >V!!# ,#w9 9@s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**t,#w E'b& >V!!# ,#w9 9@t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**u,#w E'b& >V!!# ,#w9 9@u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**v,#w E'b& >V!!# ,#w9 9@v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** w,#w E'b& >V!!# ,#w9 9@w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **x,#w E'b& >V!!# ,#w9 9@x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**y,#w E'b& >V!!# ,#w9 9@y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+wowerShell\v1 E'b& >VE'b!# ,#w9 9@z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkzz-B( Dl=f?mMF&**z,#w E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ,#w9 9@z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**{,#w E'b& >V!!# ,#w9 9@{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(|,#w E'b& >V!!# ,#w9 9@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@},#w E'b& >V!!# ,#w9 9@} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0~,#w E'b& >V!!# ,#w9 9@~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ,#w E'b& >V!!# ,#w9 9@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ,#w E'b& >V!!# ,#w9 9@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **,#w E'b& >V!!# ,#w9 9@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**,#w E'b& >V!!# ,#w9 9@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(,#w E'b& >V!!# ,#w9 9@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&HC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(վw E'b& >V!!# վw9 9H4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ͖  E'b& >V!!# ͖ CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **͖  E'b& >V!!# ͖ CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**͖  E'b& >V!!# ͖ CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**͖  E'b& >V!!# ͖ CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ͖  E'b& >V!!# ͖ CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0 E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678930** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( E'b& >V!!# CAs_xAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** -L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** -L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789M0**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** -L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** -L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** -L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(-L E'b& >V!!# -LCAshGAs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789g0**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(s E'b& >V!!# sCAstGAs  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!#   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 > E'b& >V 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational