ElfFile?ElfChnk..]LT\[Dl=f?mMF &**.>cA E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# >cAN\|~Aw|~A . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy***@/5A E'b& >V!!# 5AN\|~Aa|~Al/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**05A E'b& >V!!# 5AN\|~Aa|~Al0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**15A E'b& >V!!# 5AN\|~Aa|~Al1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**25A E'b& >V!!# 5AN\|~Aa|~Al2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** 35A E'b& >V!!# 5AN\|~Aa|~Al3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **45A E'b& >V!!# 5AN\|~Aa|~Al4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**55A E'b& >V!!# 5AN\|~Aa|~Al5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**65A E'b& >V!!# 5AN\|~Aa|~Al6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**075A E'b& >V!!# 5AN\|~Aa|~Al7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**85A E'b& >V!!# 5AN\|~Aa|~Al8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**95A E'b& >V!!# 5AN\|~Aa|~Al9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**:5A E'b& >V!!# 5AN\|~Aa|~Al: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**;5A E'b& >V!!# 5AN\|~Aa|~Al; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** <5A E'b& >V!!# 5AN\|~Aa|~Al< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **==A E'b& >V!!# =AN\|~Aa|~Al= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**>=A E'b& >V!!# =AN\|~Aa|~Al> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**?=A E'b& >V!!# =AN\|~Aa|~Al? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**@=A E'b& >V!!# =AN\|~Aa|~Al@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(A=A E'b& >V!!# =AN\|~Aa|~AlA ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@B=A E'b& >V!!# =AN\|~Aa|~AlB ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&lC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0C=A E'b& >V!!# =AN\|~Aa|~AlC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** D=A E'b& >V!!# =AN\|~Aa|~AlD ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** E=A E'b& >V!!# =AN\|~Aa|~AlE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2w **F=A E'b& >V!!# =AN\|~Aa|~AlF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**G=A E'b& >V!!# =AN\|~Aa|~AlG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(H=A E'b& >V!!# =AN\|~Aa|~AlH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** IE4 D E'b& >V!!# E4 D=CgC I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **JE4 D E'b& >V!!# E4 D=CgC J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**KE4 D E'b& >V!!# E4 D=CgC K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**LE4 D E'b& >V!!# E4 D=CgC L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ME4 D E'b& >V!!# E4 D=CgC M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **NE4 D E'b& >V!!# E4 D=CgC N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**OE4 D E'b& >V!!# E4 D=CgC O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**PE4 D E'b& >V!!# E4 D=CgC P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0QE4 D E'b& >V!!# E4 D=CgC Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**RE4 D E'b& >V!!# E4 D=CgC R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**SE4 D E'b& >V!!# E4 D=CgC S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**TE4 D E'b& >V!!# E4 D=CgC T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**UE4 D E'b& >V!!# E4 D=CgC U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** VE4 D E'b& >V!!# E4 D=CgC V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **WE4 D E'b& >V!!# E4 D=CgC W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**XE4 D E'b& >V!!# E4 D=CgC X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**YE4 D E'b& >V!!# E4 D=CgC Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**ZE4 D E'b& >V!!# E4 D=CgC Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**([E4 D E'b& >V!!# E4 D=CgC [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@\E4 D E'b& >V!!# E4 D=CgC \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0]E4 D E'b& >V!!# E4 D=CgC ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ^E4 D E'b& >V!!# E4 D=CgC ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** _E4 D E'b& >V!!# E4 D=CgC _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **`E4 D E'b& >V!!# E4 D=CgC ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**aE4 D E'b& >V!!# E4 D=CgC a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(bE4 D E'b& >V!!# E4 D=CgC b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** cXD E'b& >V!!# XD=CgC c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **dXD E'b& >V!!# XD=CgC d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**eXD E'b& >V!!# XD=CgC e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**fXD E'b& >V!!# XD=CgC f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** gXD E'b& >V!!# XD=CgC g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **hXD E'b& >V!!# XD=CgC h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**iXD E'b& >V!!# XD=CgC i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**jXD E'b& >V!!# XD=CgC j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0kXD E'b& >V!!# XD=CgC k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**lXD E'b& >V!!# XD=CgC l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**mXD E'b& >V!!# XD=CgC m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**nXD E'b& >V!!# XD=CgC n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**oXD E'b& >V!!# XD=CgC o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** pXD E'b& >V!!# XD=CgC p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **qXD E'b& >V!!# XD=CgC q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**rXD E'b& >V!!# XD=CgC r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**sXD E'b& >V!!# XD=CgC s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**tXD E'b& >V!!# XD=CgC t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(uXD E'b& >V!!# XD=CgC u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@vXD E'b& >V!!# XD=CgC v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0wXD E'b& >V!!# XD=CgC w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** xXD E'b& >V!!# XD=CgC x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** yXD E'b& >V!!# XD=CgC y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **zXD E'b& >V!!# XD=CgC z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**{XD E'b& >V!!# XD=CgC { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(|XD E'b& >V!!# XD=CgC | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** }wD E'b& >V!!# wD=CgC} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **~wD E'b& >V!!# wD=CgC~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(wD E'b& >V!!# wD=CgC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20owershell.ex E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk# |Dl=f?mMF=)&**vQm{F E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M **vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(vQm{F E'b& >V!!# vQm{FS@=Fj=F $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=)6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567892w0**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-f**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyD@**0q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttD0** q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyD@**0ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttD0** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyD@**0hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttD0** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**  ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe ** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyF@**0]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttF0** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk22HDpF΀qDl=f?mMF&**]H E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M **]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**d^H E'b& >V!!# d^H@B2GaB2G 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o** d^H E'b& >V!!# d^H@B2GaB2G 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0!d^H E'b& >V!!# d^H@B2GaB2G 0! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**"d^H E'b& >V!!# d^H@B2GaB2G 0" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**#d^H E'b& >V!!# d^H@B2GaB2G 0# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**$d^H E'b& >V!!# d^H@B2GaB2G 0$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**%d^H E'b& >V!!# d^H@B2GaB2G 0% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** &d^H E'b& >V!!# d^H@B2GaB2G 0& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **'d^H E'b& >V!!# d^H@B2GaB2G 0' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**(d^H E'b& >V!!# d^H@B2GaB2G 0( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**)d^H E'b& >V!!# d^H@B2GaB2G 0) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h***d^H E'b& >V!!# d^H@B2GaB2G 0* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(+d^H E'b& >V!!# d^H@B2GaB2G 0+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@,d^H E'b& >V!!# d^H@B2GaB2G 0, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0-d^H E'b& >V!!# d^H@B2GaB2G 0- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** .d^H E'b& >V!!# d^H@B2GaB2G 0. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** /d^H E'b& >V!!# d^H@B2GaB2G 0/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **0d^H E'b& >V!!# d^H@B2GaB2G 00 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**1d^H E'b& >V!!# d^H@B2GaB2G 01 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(2d^H E'b& >V!!# d^H@B2GaB2G 02 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyD@**0q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttD0** q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(q{F E'b& >V!!# q{FS@=F3G=F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyD@**0ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttD0** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ev{F E'b& >V!!# ev{FS@=F4k=F  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyD@**0hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttD0** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(hu{[H E'b& >V!!# hu{[H@B2GmFB2G X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**  ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe ** ]H E'b& >V!!# ]H@B2GzFB2G  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyF@**0]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttF0** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ]H E'b& >V!!# ]H@B2GzFB2G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkJJMv!EDl=f?mMF &**J6M E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# 6MfJFQFJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy***@KL~kM E'b& >V!!# L~kMfJFWuF K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**LL~kM E'b& >V!!# L~kMfJFWuF L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**ML~kM E'b& >V!!# L~kMfJFWuF M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**NL~kM E'b& >V!!# L~kMfJFWuF N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** OL~kM E'b& >V!!# L~kMfJFWuF O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **PL~kM E'b& >V!!# L~kMfJFWuF P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**QL~kM E'b& >V!!# L~kMfJFWuF Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**RL~kM E'b& >V!!# L~kMfJFWuF R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0SL~kM E'b& >V!!# L~kMfJFWuF S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**TL~kM E'b& >V!!# L~kMfJFWuF T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**UL~kM E'b& >V!!# L~kMfJFWuF U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**VL~kM E'b& >V!!# L~kMfJFWuF V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**WL~kM E'b& >V!!# L~kMfJFWuF W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** XL~kM E'b& >V!!# L~kMfJFWuF X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **YL~kM E'b& >V!!# L~kMfJFWuF Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**ZL~kM E'b& >V!!# L~kMfJFWuF Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**[L~kM E'b& >V!!# L~kMfJFWuF [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**\L~kM E'b& >V!!# L~kMfJFWuF \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(]L~kM E'b& >V!!# L~kMfJFWuF ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@^L~kM E'b& >V!!# L~kMfJFWuF ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0_L~kM E'b& >V!!# L~kMfJFWuF _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** `L~kM E'b& >V!!# L~kMfJFWuF ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** aL~kM E'b& >V!!# L~kMfJFWuF a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2w **bL~kM E'b& >V!!# L~kMfJFWuF b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**cL~kM E'b& >V!!# L~kMfJFWuF c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(dL~kM E'b& >V!!# L~kMfJFWuF d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** eNM E'b& >V!!# NMfJFfuF$p e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **fNM E'b& >V!!# NMfJFfuF$p f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**gNM E'b& >V!!# NMfJFfuF$p g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**hNM E'b& >V!!# NMfJFfuF$p h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** iNM E'b& >V!!# NMfJFfuF$p i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **jNM E'b& >V!!# NMfJFfuF$p j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**kNM E'b& >V!!# NMfJFfuF$p k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**lNM E'b& >V!!# NMfJFfuF$p l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0mNM E'b& >V!!# NMfJFfuF$p m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**nNM E'b& >V!!# NMfJFfuF$p n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**oNM E'b& >V!!# NMfJFfuF$p o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**pNM E'b& >V!!# NMfJFfuF$p p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**qNM E'b& >V!!# NMfJFfuF$p q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** rNM E'b& >V!!# NMfJFfuF$p r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **sNM E'b& >V!!# NMfJFfuF$p s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**tNM E'b& >V!!# NMfJFfuF$p t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**uNM E'b& >V!!# NMfJFfuF$p u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**vNM E'b& >V!!# NMfJFfuF$p v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(wNM E'b& >V!!# NMfJFfuF$p w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@xNM E'b& >V!!# NMfJFfuF$p x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0yNM E'b& >V!!# NMfJFfuF$p y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** zNM E'b& >V!!# NMfJFfuF$p z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** {NM E'b& >V!!# NMfJFfuF$p { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2, **|NM E'b& >V!!# NMfJFfuF$p | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**}NM E'b& >V!!# NMfJFfuF$p } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(~NM E'b& >V!!# NMfJFfuF$p ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(٨ߔ E'b& >V!!# ٨ߔ8 k : k $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0 E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w**  E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh ** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**( E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0 E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670**  E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q **  E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 ** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( E'b& >V!!# 8 k/ k8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20owershell.ex E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk11tzbT`Dl=f?mMF=)&**ꪗ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M **ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(ꪗ E'b& >V!!# ꪗ8 k; k  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=)6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** % E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**% E'b& >V!!# %@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567892w0**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-f**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** -& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(-& E'b& >V!!# -&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@9>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**09>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 9>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** 9>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **9>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**9>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(9>& E'b& >V!!# 9>&@#N  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-US\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567892,0**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**t E'b& >V!!# t@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(u E'b& >V!!# u@#ON\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**   E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-USDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0  E'b& >V!!#  @#q)D  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**  E'b& >V!!#  @#q)D  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**  E'b& >V!!#  @#q)D  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**  E'b& >V!!#  @#q)D  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**  E'b& >V!!#  @#q)D  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**   E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&DC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**   E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& **   E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(  E'b& >V!!#  @#q)D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** i` E'b& >V!!# i`&"_-"P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2=) ten-USP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **y=` E'b& >V!!# y=`&"_-"P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**y=` E'b& >V!!# y=`&"_-"P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**y=` E'b& >V!!# y=`&"_-"P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** y=` E'b& >V!!# y=`&"_-"P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** y=` E'b& >V!!# y=`&"_-"P   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!y=` E'b& >V!!# y=`&"_-"P ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**"y=` E'b& >V!!# y=`&"_-"P " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0#d` E'b& >V!!# d`&"_-"P # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**$d` E'b& >V!!# d`&"_-"P $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**%d` E'b& >V!!# d`&"_-"P % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**&d` E'b& >V!!# d`&"_-"P & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**'d` E'b& >V!!# d`&"_-"P ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** (d` E'b& >V!!# d`&"_-"P ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **)d` E'b& >V!!# d`&"_-"P ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1***d` E'b& >V!!# d`&"_-"P * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**+d` E'b& >V!!# d`&"_-"P + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**,d` E'b& >V!!# d`&"_-"P , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(-d` E'b& >V!!# d`&"_-"P - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@.d` E'b& >V!!# d`&"_-"P . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&P C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0/d` E'b& >V!!# d`&"_-"P / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 0d` E'b& >V!!# d`&"_-"P 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** 1d` E'b& >V!!# d`&"_-"P 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk22p5p3Gɞ[Dl=f?mMF&**2d` E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# d`&"_-"P 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M **3d` E'b& >V!!# d`&"_-"P 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(4` E'b& >V!!# `&"_-"P 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@5$C` E'b& >V!!# $C`&"R"5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**6$C` E'b& >V!!# $C`&"R"6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**7$C` E'b& >V!!# $C`&"R"7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**8$C` E'b& >V!!# $C`&"R"8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** 9$C` E'b& >V!!# $C`&"R"9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **:$C` E'b& >V!!# $C`&"R": ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**;$C` E'b& >V!!# $C`&"R"; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**<$C` E'b& >V!!# $C`&"R"< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0=$C` E'b& >V!!# $C`&"R"= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**>$C` E'b& >V!!# $C`&"R"> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**?$C` E'b& >V!!# $C`&"R"? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**@$C` E'b& >V!!# $C`&"R"@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**A$C` E'b& >V!!# $C`&"R"A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** B$C` E'b& >V!!# $C`&"R"B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **C$C` E'b& >V!!# $C`&"R"C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**D$C` E'b& >V!!# $C`&"R"D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**E$C` E'b& >V!!# $C`&"R"E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**F$C` E'b& >V!!# $C`&"R"F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(G$C` E'b& >V!!# $C`&"R"G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@HKC` E'b& >V!!# KC`&"R"H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0IKC` E'b& >V!!# KC`&"R"I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** JKC` E'b& >V!!# KC`&"R"J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** KKC` E'b& >V!!# KC`&"R"K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **LKC` E'b& >V!!# KC`&"R"L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**MKC` E'b& >V!!# KC`&"R"M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(NKC` E'b& >V!!# KC`&"R"N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** O` E'b& >V!!# `&"R", O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **P` E'b& >V!!# `&"R", P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Q` E'b& >V!!# `&"R", Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**R` E'b& >V!!# `&"R", R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** S` E'b& >V!!# `&"R", S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **T` E'b& >V!!# `&"R", T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**U` E'b& >V!!# `&"R", U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**V` E'b& >V!!# `&"R", V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0W` E'b& >V!!# `&"R", W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**X` E'b& >V!!# `&"R", X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**Y` E'b& >V!!# `&"R", Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**Z` E'b& >V!!# `&"R", Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**[` E'b& >V!!# `&"R", [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** \D` E'b& >V!!# D`&"R", \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **]D` E'b& >V!!# D`&"R", ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**^D` E'b& >V!!# D`&"R", ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**_D` E'b& >V!!# D`&"R", _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**`D` E'b& >V!!# D`&"R", ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(aD` E'b& >V!!# D`&"R", a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@bD` E'b& >V!!# D`&"R", b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0cD` E'b& >V!!# D`&"R", c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** dD` E'b& >V!!# D`&"R", d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** eD` E'b& >V!!# D`&"R", e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **fD` E'b& >V!!# D`&"R", f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**gD` E'b& >V!!# D`&"R", g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(hD` E'b& >V!!# D`&"R", h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** iY  E'b& >V!!# Y G} P} li ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **jY  E'b& >V!!# Y G} P} lj ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**kY  E'b& >V!!# Y G} P} lk ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**lY  E'b& >V!!# Y G} P} ll ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** mq  E'b& >V!!# q G} P} lm ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **nq  E'b& >V!!# q G} P} ln ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**oq  E'b& >V!!# q G} P} lo ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**pq  E'b& >V!!# q G} P} lp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0q$  E'b& >V!!# $ G} P} lq ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**r$  E'b& >V!!# $ G} P} lr ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**s$  E'b& >V!!# $ G} P} ls ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**t$  E'b& >V!!# $ G} P} lt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**u$  E'b& >V!!# $ G} P} lu ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** v$  E'b& >V!!# $ G} P} lv ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **w$  E'b& >V!!# $ G} P} lw ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**x$  E'b& >V!!# $ G} P} lx ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**y$  E'b& >V!!# $ G} P} ly ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**z$  E'b& >V!!# $ G} P} lz ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**({$  E'b& >V!!# $ G} P} l{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@|$  E'b& >V!!# $ G} P} l| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&lC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0}$  E'b& >V!!# $ G} P} l} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ~$  E'b& >V!!# $ G} P} l~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** $  E'b& >V!!# $ G} P} l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **$  E'b& >V!!# $ G} P} l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**$  E'b& >V!!# $ G} P} l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**($  E'b& >V!!# $ G} P} l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** >  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** >  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0>  E'b& >V!!# > G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w**   E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670**   E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q **   E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(  E'b& >V!!#  G} v} 0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**   E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0  E'b& >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0shell.exe  E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk t](Dl=f?mMFm-&**  E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!#  G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-M **!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** !@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** !@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(!@  E'b& >V!!# !@ G} w} d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2m-6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** >G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**>G# E'b& >V!!# >G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-M**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0׌G# E'b& >V!!# ׌G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** G# E'b& >V!!# G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** G# E'b& >V!!# G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **G# E'b& >V!!# G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**G# E'b& >V!!# G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(G# E'b& >V!!# G#"" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** g# E'b& >V!!# g#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2m- ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **g# E'b& >V!!# g#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**g# E'b& >V!!# g#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**g# E'b& >V!!# g#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** g# E'b& >V!!# g#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-M**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**0rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(rC# E'b& >V!!# rC#"&" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** #ǜ# E'b& >V!!# #ǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2m- ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-M**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**0Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Jǜ# E'b& >V!!# Jǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(qǜ# E'b& >V!!# qǜ#"8"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2m- ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  yb,{% E'b& >V!!# yb,{%4%ɵ4%   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** yb,{% E'b& >V!!# yb,{%4%ɵ4%   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** yb,{% E'b& >V!!# yb,{%4%ɵ4%   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** yb,{% E'b& >V!!# yb,{%4%ɵ4%   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 yb,{% E'b& >V!!# yb,{%4%ɵ4%   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-M**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**0yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0b& E'b& >V>V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkxYBDl=f?mMF&**yb,{% E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM** **yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(yb,{% E'b& >V!!# yb,{%4%ɵ4%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@V.{% E'b& >V!!# V.{%4%<4%X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exendow@** V.{% E'b& >V!!# V.{%4%<4%X   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**!V.{% E'b& >V!!# V.{%4%<4%X ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .w**"V.{% E'b& >V!!# V.{%4%<4%X " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** #V.{% E'b& >V!!# V.{%4%<4%X # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0-Wi **$V.{% E'b& >V!!# V.{%4%<4%X $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0l**%V.{% E'b& >V!!# V.{%4%<4%X % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0I**&V.{% E'b& >V!!# V.{%4%<4%X & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $o**0'V.{% E'b& >V!!# V.{%4%<4%X ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789nter0**(V.{% E'b& >V!!# V.{%4%<4%X ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-r**)V.{% E'b& >V!!# V.{%4%<4%X ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r***V.{% E'b& >V!!# V.{%4%<4%X * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .o**+V.{% E'b& >V!!# V.{%4%<4%X + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,S** ,V.{% E'b& >V!!# V.{%4%<4%X , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll\ **-V.{% E'b& >V!!# V.{%4%<4%X - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1\**.V.{% E'b& >V!!# V.{%4%<4%X . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+\**/V.{% E'b& >V!!# V.{%4%<4%X / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /\**0V.{% E'b& >V!!# V.{%4%<4%X 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(1V.{% E'b& >V!!# V.{%4%<4%X 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy.0(**@2V.{% E'b& >V!!# V.{%4%<4%X 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&X C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**03V.{% E'b& >V!!# V.{%4%<4%X 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt890** 4V.{% E'b& >V!!# V.{%4%<4%X 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM-M ** 5V.{% E'b& >V!!# V.{%4%<4%X 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM** **6V.{% E'b& >V!!# V.{%4%<4%X 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**7V.{% E'b& >V!!# V.{%4%<4%X 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(8V.{% E'b& >V!!# V.{%4%<4%X 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tX C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 9X/{% E'b& >V!!# X/{%4%N4% 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **:X/{% E'b& >V!!# X/{%4%N4% : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**;X/{% E'b& >V!!# X/{%4%N4% ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**<X/{% E'b& >V!!# X/{%4%N4% < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** =X/{% E'b& >V!!# X/{%4%N4% = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **>X/{% E'b& >V!!# X/{%4%N4% > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0d**?X/{% E'b& >V!!# X/{%4%N4% ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0.**@X/{% E'b& >V!!# X/{%4%N4% @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $0**0AX/{% E'b& >V!!# X/{%4%N4% A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ersh0**BX/{% E'b& >V!!# X/{%4%N4% B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**CX/{% E'b& >V!!# X/{%4%N4% C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**DX/{% E'b& >V!!# X/{%4%N4% D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .w**EX/{% E'b& >V!!# X/{%4%N4% E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** FX/{% E'b& >V!!# X/{%4%N4% F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll\ **GX/{% E'b& >V!!# X/{%4%N4% G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1\**HX/{% E'b& >V!!# X/{%4%N4% H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+\**IX/{% E'b& >V!!# X/{%4%N4% I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /\**JX/{% E'b& >V!!# X/{%4%N4% J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(KX/{% E'b& >V!!# X/{%4%N4% K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy.0(**@LX/{% E'b& >V!!# X/{%4%N4% L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**0MX/{% E'b& >V!!# X/{%4%N4% M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt890** NX/{% E'b& >V!!# X/{%4%N4% N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM-M ** OX/{% E'b& >V!!# X/{%4%N4% O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM** **PX/{% E'b& >V!!# X/{%4%N4% P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**QX/{% E'b& >V!!# X/{%4%N4% Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(RX/{% E'b& >V!!# X/{%4%N4% R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** Sv;& E'b& >V!!# v;&,)%#4)% x S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **Tv;& E'b& >V!!# v;&,)%#4)% x T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Uv;& E'b& >V!!# v;&,)%#4)% x U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Vv;& E'b& >V!!# v;&,)%#4)% x V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Wv;& E'b& >V!!# v;&,)%#4)% x W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Xv;& E'b& >V!!# v;&,)%#4)% x X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0d**Yv;& E'b& >V!!# v;&,)%#4)% x Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0.**Zv;& E'b& >V!!# v;&,)%#4)% x Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $0**0[v;& E'b& >V!!# v;&,)%#4)% x [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ersh0**\v;& E'b& >V!!# v;&,)%#4)% x \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**]v;& E'b& >V!!# v;&,)%#4)% x ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**^v;& E'b& >V!!# v;&,)%#4)% x ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .w**_v;& E'b& >V!!# v;&,)%#4)% x _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** `v;& E'b& >V!!# v;&,)%#4)% x ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll\ **av;& E'b& >V!!# v;&,)%#4)% x a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1\**bv;& E'b& >V!!# v;&,)%#4)% x b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+\**cv;& E'b& >V!!# v;&,)%#4)% x c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /\**dv;& E'b& >V!!# v;&,)%#4)% x d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(ev;& E'b& >V!!# v;&,)%#4)% x e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy.0(**@fv;& E'b& >V!!# v;&,)%#4)% x f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**0gv;& E'b& >V!!# v;&,)%#4)% x g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt890** hv;& E'b& >V!!# v;&,)%#4)% x h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM-M ** iv;& E'b& >V!!# v;&,)%#4)% x i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM** **jv;& E'b& >V!!# v;&,)%#4)% x j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**kv;& E'b& >V!!# v;&,)%#4)% x k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(lv;& E'b& >V!!# v;&,)%#4)% x l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** m];& E'b& >V!!# ];&,)%74)% m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **n];& E'b& >V!!# ];&,)%74)% n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**o];& E'b& >V!!# ];&,)%74)% o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**p];& E'b& >V!!# ];&,)%74)% p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** q];& E'b& >V!!# ];&,)%74)% q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **r];& E'b& >V!!# ];&,)%74)% r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0d**s];& E'b& >V!!# ];&,)%74)% s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0.**t];& E'b& >V!!# ];&,)%74)% t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $0**0u];& E'b& >V!!# ];&,)%74)% u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ersh0**v];& E'b& >V!!# ];&,)%74)% v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**w];& E'b& >V!!# ];&,)%74)% w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**x];& E'b& >V!!# ];&,)%74)% x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .w**y];& E'b& >V!!# ];&,)%74)% y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** z];& E'b& >V!!# ];&,)%74)% z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll\ **{];& E'b& >V!!# ];&,)%74)% { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1\**|];& E'b& >V!!# ];&,)%74)% | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+\**}];& E'b& >V!!# ];&,)%74)% } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /\**~];& E'b& >V!!# ];&,)%74)% ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy.0(**@];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy @**0];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt890** ];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM-M ** ];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM** **];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(];& E'b& >V!!# ];&,)%74)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** &4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, **&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2,**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .,**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,,** &4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0d**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0.e h:mm:s E'b& >V!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkp~|LDl=f?mMF1&**&4;& E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $ **0&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** &4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ter **&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1r**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+r**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /r**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :I**(&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyti(**@&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyosof@**0&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tts-In0** &4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMt-Wi ** &4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMndow **&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6w**&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0w**(&4;& E'b& >V!!# &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyn(**@( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ216Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**( E'b& >V!!# (\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $M**0/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678960**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** /( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**/( E'b& >V!!# /(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Ԓ( E'b& >V!!# Ԓ(\/Y(1\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** OM( E'b& >V!!# OM(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ21 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $M**0St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789P0**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**St( E'b& >V!!# St(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(_( E'b& >V!!# _(\/Y(@\/Y(p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** `a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ21 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** `a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $M**0`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789j0**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** `a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@`a( E'b& >V!!# `a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0{(a( E'b& >V!!# {(a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** {(a( E'b& >V!!# {(a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** {(a( E'b& >V!!# {(a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **{(a( E'b& >V!!# {(a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**{(a( E'b& >V!!# {(a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**({(a( E'b& >V!!# {(a(\/Y(H\/Y(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ21 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $M**0e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0, **e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1,**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+,**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(h:mm:s E' E'b& >V &4;&,)%W)%  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkuuVG@a#Dl=f?mMF]&** e}+ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy **0e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt&0** e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(e}+ E'b& >V!!# e}+G7*=?* L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@ NJ+ E'b& >V!!# NJ+G7*Q?*  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2]6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeOper@** NJ+ E'b& >V!!# NJ+G7*Q?*  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r** NJ+ E'b& >V!!# NJ+G7*Q?*  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r** NJ+ E'b& >V!!# NJ+G7*Q?*  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,r**  NJ+ E'b& >V!!# NJ+G7*Q?*  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0al/ **NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789Micr0**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-r**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l** NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy(@**0NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt(0** NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** NJ+ E'b& >V!!# NJ+G7*Q?* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** NJ+ E'b& >V!!# NJ+G7*Q?*  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**!NJ+ E'b& >V!!# NJ+G7*Q?*! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**("NJ+ E'b& >V!!# NJ+G7*Q?*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** #΀+ E'b& >V!!# ΀+G7*]?*d# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2] ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **$΀+ E'b& >V!!# ΀+G7*]?*d$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**%΀+ E'b& >V!!# ΀+G7*]?*d% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**&΀+ E'b& >V!!# ΀+G7*]?*d& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** '΀+ E'b& >V!!# ΀+G7*]?*d' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **(΀+ E'b& >V!!# ΀+G7*]?*d( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**)΀+ E'b& >V!!# ΀+G7*]?*d) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***΀+ E'b& >V!!# ΀+G7*]?*d* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0+΀+ E'b& >V!!# ΀+G7*]?*d+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**,΀+ E'b& >V!!# ΀+G7*]?*d, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**-΀+ E'b& >V!!# ΀+G7*]?*d- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**.΀+ E'b& >V!!# ΀+G7*]?*d. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**/΀+ E'b& >V!!# ΀+G7*]?*d/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** 0΀+ E'b& >V!!# ΀+G7*]?*d0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **1΀+ E'b& >V!!# ΀+G7*]?*d1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**2΀+ E'b& >V!!# ΀+G7*]?*d2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**3΀+ E'b& >V!!# ΀+G7*]?*d3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**4΀+ E'b& >V!!# ΀+G7*]?*d4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(5΀+ E'b& >V!!# ΀+G7*]?*d5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@6΀+ E'b& >V!!# ΀+G7*]?*d6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy(@**07΀+ E'b& >V!!# ΀+G7*]?*d7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt(0** 8΀+ E'b& >V!!# ΀+G7*]?*d8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** 9΀+ E'b& >V!!# ΀+G7*]?*d9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **:΀+ E'b& >V!!# ΀+G7*]?*d: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**;΀+ E'b& >V!!# ΀+G7*]?*d; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(<΀+ E'b& >V!!# ΀+G7*]?*d< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** =!}, E'b& >V!!# !},!}, E'b& >V!!# !}, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**?!}, E'b& >V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# !},V!!# 3= },V!!# 3= },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!# I? },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkvvp2,]Dl=f?mMF5&**v }, E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!#  },V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ256Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**xK. E'b& >V!!# xK.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**07K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** 7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**7K. E'b& >V!!# 7K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** +K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** +K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(+K. E'b& >V!!# +K.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** . E'b& >V!!# .0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(,. E'b& >V!!# ,.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 4. E'b& >V!!# 4.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **4. E'b& >V!!# 4.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** =. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** =. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** =. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** =. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(=. E'b& >V!!# =.0..  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 8hSD1 E'b& >V!!# 8hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25 ten-UStC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **8hSD1 E'b& >V!!# 8hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** hSD1 E'b& >V!!#  hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** hSD1 E'b& >V!!#  hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  hSD1 E'b& >V!!#  hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** hSD1 E'b& >V!!#  hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M** hSD1 E'b& >V!!#  hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h** hSD1 E'b& >V!!#  hSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /hl\v1.0\power E'b& >V!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk]]鮇6eDl=f?mMF&**oiSD1 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :d,**(oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(oiSD1 E'b& >V!!# oiSD1Q0*Q0tt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ttC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@VD1 E'b& >V!!# VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.@**VD1 E'b& >V!!# VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**VD1 E'b& >V!!# VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**VD1 E'b& >V!!# VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** VD1 E'b& >V!!# VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0al **VD1 E'b& >V!!# VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $f**0?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ndow0**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .f**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :M**(?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  ?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** ?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** ?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( ?VD1 E'b& >V!!# ?VD1Q0_Q0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  -VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** -VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789+K0**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** -VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**-VD1 E'b& >V!!# -VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :M**(D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&LC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0!D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** "D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** #D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **$D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**%D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(&D.VD1 E'b& >V!!# D.VD1Q0lQ0Lx & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** '+K3 E'b& >V!!# +K3@Y3q_Y3P ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **(?r3 E'b& >V!!# ?r3@Y3q_Y3P ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**)?r3 E'b& >V!!# ?r3@Y3q_Y3P ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .***?r3 E'b& >V!!# ?r3@Y3q_Y3P * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** +?r3 E'b& >V!!# ?r3@Y3q_Y3P + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **,?r3 E'b& >V!!# ?r3@Y3q_Y3P , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**-?r3 E'b& >V!!# ?r3@Y3q_Y3P - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**.?r3 E'b& >V!!# ?r3@Y3q_Y3P . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0/R3 E'b& >V!!# R3@Y3q_Y3P / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789,0**0R3 E'b& >V!!# R3@Y3q_Y3P 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**1R3 E'b& >V!!# R3@Y3q_Y3P 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**2R3 E'b& >V!!# R3@Y3q_Y3P 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**3R3 E'b& >V!!# R3@Y3q_Y3P 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 4R3 E'b& >V!!# R3@Y3q_Y3P 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **5R3 E'b& >V!!# R3@Y3q_Y3P 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**6R3 E'b& >V!!# R3@Y3q_Y3P 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**7R3 E'b& >V!!# R3@Y3q_Y3P 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**8R3 E'b& >V!!# R3@Y3q_Y3P 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :M**(9R3 E'b& >V!!# R3@Y3q_Y3P 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@:R3 E'b& >V!!# R3@Y3q_Y3P : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&P C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0;R3 E'b& >V!!# R3@Y3q_Y3P ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** <R3 E'b& >V!!# R3@Y3q_Y3P < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** =3 E'b& >V!!# 3@Y3q_Y3P = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **>3 E'b& >V!!# 3@Y3q_Y3P > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**?3 E'b& >V!!# 3@Y3q_Y3P ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(@3 E'b& >V!!# 3@Y3q_Y3P @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** AC 3 E'b& >V!!# C 3@Y3_Y3 A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **BC 3 E'b& >V!!# C 3@Y3_Y3 B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**CC 3 E'b& >V!!# C 3@Y3_Y3 C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**DC 3 E'b& >V!!# C 3@Y3_Y3 D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** EC 3 E'b& >V!!# C 3@Y3_Y3 E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **FC 3 E'b& >V!!# C 3@Y3_Y3 F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**GC 3 E'b& >V!!# C 3@Y3_Y3 G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**HC 3 E'b& >V!!# C 3@Y3_Y3 H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0IC 3 E'b& >V!!# C 3@Y3_Y3 I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789=0**JC 3 E'b& >V!!# C 3@Y3_Y3 J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**KC 3 E'b& >V!!# C 3@Y3_Y3 K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**LC 3 E'b& >V!!# C 3@Y3_Y3 L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**MC 3 E'b& >V!!# C 3@Y3_Y3 M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** NC 3 E'b& >V!!# C 3@Y3_Y3 N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **OC 3 E'b& >V!!# C 3@Y3_Y3 O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**PC 3 E'b& >V!!# C 3@Y3_Y3 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**QC 3 E'b& >V!!# C 3@Y3_Y3 Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**RC 3 E'b& >V!!# C 3@Y3_Y3 R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :M**(SC 3 E'b& >V!!# C 3@Y3_Y3 S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@TC 3 E'b& >V!!# C 3@Y3_Y3 T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0UC 3 E'b& >V!!# C 3@Y3_Y3 U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** VC 3 E'b& >V!!# C 3@Y3_Y3 V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** WC 3 E'b& >V!!# C 3@Y3_Y3 W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **XC 3 E'b& >V!!# C 3@Y3_Y3 X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**YC 3 E'b& >V!!# C 3@Y3_Y3 Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ZC 3 E'b& >V!!# C 3@Y3_Y3 Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** [D: 3 E'b& >V!!# D: 3@Y3_Y3 [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **\(a 3 E'b& >V!!# (a 3@Y3_Y3 \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**](a 3 E'b& >V!!# (a 3@Y3_Y3 ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .>V E'b& >VMicrosoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk^^x ?:|QDl=f?mMF:&**^(a 3 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# (a 3@Y3_Y3 ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,d,** _(a 3 E'b& >V!!# (a 3@Y3_Y3 _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **`(a 3 E'b& >V!!# (a 3@Y3_Y3 ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**a(a 3 E'b& >V!!# (a 3@Y3_Y3 a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**b(a 3 E'b& >V!!# (a 3@Y3_Y3 b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0c(a 3 E'b& >V!!# (a 3@Y3_Y3 c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**d(a 3 E'b& >V!!# (a 3@Y3_Y3 d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**e(a 3 E'b& >V!!# (a 3@Y3_Y3 e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**f(a 3 E'b& >V!!# (a 3@Y3_Y3 f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**g(a 3 E'b& >V!!# (a 3@Y3_Y3 g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** h(a 3 E'b& >V!!# (a 3@Y3_Y3 h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **i(a 3 E'b& >V!!# (a 3@Y3_Y3 i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**j(a 3 E'b& >V!!# (a 3@Y3_Y3 j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**k(a 3 E'b& >V!!# (a 3@Y3_Y3 k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**l(a 3 E'b& >V!!# (a 3@Y3_Y3 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : **(m(a 3 E'b& >V!!# (a 3@Y3_Y3 m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@n(a 3 E'b& >V!!# (a 3@Y3_Y3 n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0o(a 3 E'b& >V!!# (a 3@Y3_Y3 o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** p(a 3 E'b& >V!!# (a 3@Y3_Y3 p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** q(a 3 E'b& >V!!# (a 3@Y3_Y3 q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **r(a 3 E'b& >V!!# (a 3@Y3_Y3 r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**s(a 3 E'b& >V!!# (a 3@Y3_Y3 s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(t(a 3 E'b& >V!!# (a 3@Y3_Y3 t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@uٱi5 E'b& >V!!# ٱi5LC5J5u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2:6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**vٱi5 E'b& >V!!# ٱi5LC5J5v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**wٱi5 E'b& >V!!# ٱi5LC5J5w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**xٱi5 E'b& >V!!# ٱi5LC5J5x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,M** yٱi5 E'b& >V!!# ٱi5LC5J5y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **zٱi5 E'b& >V!!# ٱi5LC5J5z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**{ٱi5 E'b& >V!!# ٱi5LC5J5{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**|ٱi5 E'b& >V!!# ٱi5LC5J5| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0}ٱi5 E'b& >V!!# ٱi5LC5J5} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**~ٱi5 E'b& >V!!# ٱi5LC5J5~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ٱi5 E'b& >V!!# ٱi5LC5J5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2: ten-US\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,M**  l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy ** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0 l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3**  l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow ** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**( l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0 l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0**  l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. **  l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe ** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( l5 E'b& >V!!#  l5LC5J5\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2: ten-US@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,M** l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(l5 E'b& >V!!# l5LC5J5@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2: ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,M** ?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** ?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1wowerShell\v1 E'b& >VE'b!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkEEv<_(Dl=f?mMF &**?-_8 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+d,**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(?-_8 E'b& >V!!# ?-_8ڟ88 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@ _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 ** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . ** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , **  _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio ** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0 _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+M** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( _8 E'b& >V!!#  _8ڟ8C8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-UST C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+M**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( N _8 E'b& >V!!# N _8ڟ8Q8T L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ N _8 E'b& >V!!# N _8ڟ8Q8T L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&T C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 N _8 E'b& >V!!# N _8ڟ8Q8T L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  N _8 E'b& >V!!# N _8ڟ8Q8T L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  N _8 E'b& >V!!# N _8ڟ8Q8T L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(N _8 E'b& >V!!# N _8ڟ8Q8T L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** !r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **!r: E'b& >V!!# !r:(k:.k: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** !r: E'b& >V!!# !r:(k:.k:  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+M**!!r: E'b& >V!!# !r:(k:.k:! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**"!r: E'b& >V!!# !r:(k:.k:" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(#!r: E'b& >V!!# !r:(k:.k:# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@$!r: E'b& >V!!# !r:(k:.k:$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0%!r: E'b& >V!!# !r:(k:.k:% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** &!r: E'b& >V!!# !r:(k:.k:& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** '!r: E'b& >V!!# !r:(k:.k:' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **(!r: E'b& >V!!# !r:(k:.k:( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**)!r: E'b& >V!!# !r:(k:.k:) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(*!r: E'b& >V!!# !r:(k:.k:* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** +B: E'b& >V!!# B:(k:9Gk: + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **,B: E'b& >V!!# B:(k:9Gk: , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**-B: E'b& >V!!# B:(k:9Gk: - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**.B: E'b& >V!!# B:(k:9Gk: . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** /B: E'b& >V!!# B:(k:9Gk: / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **0B: E'b& >V!!# B:(k:9Gk: 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**1B: E'b& >V!!# B:(k:9Gk: 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**2B: E'b& >V!!# B:(k:9Gk: 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**03B: E'b& >V!!# B:(k:9Gk: 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**4B: E'b& >V!!# B:(k:9Gk: 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**5B: E'b& >V!!# B:(k:9Gk: 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**6B: E'b& >V!!# B:(k:9Gk: 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**7B: E'b& >V!!# B:(k:9Gk: 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 8B: E'b& >V!!# B:(k:9Gk: 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **9B: E'b& >V!!# B:(k:9Gk: 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**:B: E'b& >V!!# B:(k:9Gk: : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+M**;B: E'b& >V!!# B:(k:9Gk: ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**<B: E'b& >V!!# B:(k:9Gk: < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(=B: E'b& >V!!# B:(k:9Gk: = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@>B: E'b& >V!!# B:(k:9Gk: > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0?B: E'b& >V!!# B:(k:9Gk: ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** @B: E'b& >V!!# B:(k:9Gk: @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** AB: E'b& >V!!# B:(k:9Gk: A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **BB: E'b& >V!!# B:(k:9Gk: B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**CB: E'b& >V!!# B:(k:9Gk: C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(DB: E'b& >V!!# B:(k:9Gk: D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** EA: E'b& >V!!# A:(k:FGk: xE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  > E'b& >V 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkFFpc&**FA: E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# A:(k:FGk: xF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2d,**GA: E'b& >V!!# A:(k:FGk: xG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**HA: E'b& >V!!# A:(k:FGk: xH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** IA: E'b& >V!!# A:(k:FGk: xI ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **JA: E'b& >V!!# A:(k:FGk: xJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**KA: E'b& >V!!# A:(k:FGk: xK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**LA: E'b& >V!!# A:(k:FGk: xL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0MA: E'b& >V!!# A:(k:FGk: xM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**NA: E'b& >V!!# A:(k:FGk: xN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**OA: E'b& >V!!# A:(k:FGk: xO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**PA: E'b& >V!!# A:(k:FGk: xP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**QA: E'b& >V!!# A:(k:FGk: xQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** RA: E'b& >V!!# A:(k:FGk: xR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **SA: E'b& >V!!# A:(k:FGk: xS ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**TA: E'b& >V!!# A:(k:FGk: xT ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**UA: E'b& >V!!# A:(k:FGk: xU ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**VA: E'b& >V!!# A:(k:FGk: xV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(WA: E'b& >V!!# A:(k:FGk: xW ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@XA: E'b& >V!!# A:(k:FGk: xX ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0YA: E'b& >V!!# A:(k:FGk: xY ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** ZA: E'b& >V!!# A:(k:FGk: xZ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** [A: E'b& >V!!# A:(k:FGk: x[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **\A: E'b& >V!!# A:(k:FGk: x\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**]A: E'b& >V!!# A:(k:FGk: x] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(^A: E'b& >V!!# A:(k:FGk: x^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@_a= E'b& >V!!# a=Y~<)}~<_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2M>6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**`a= E'b& >V!!# a=Y~<)}~<` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2M**aa= E'b& >V!!# a=Y~<)}~<a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ba= E'b& >V!!# a=Y~<)}~<b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ca= E'b& >V!!# a=Y~<)}~<c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **da= E'b& >V!!# a=Y~<)}~<d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ea= E'b& >V!!# a=Y~<)}~<e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**fa= E'b& >V!!# a=Y~<)}~<f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0ga= E'b& >V!!# a=Y~<)}~<g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**ha= E'b& >V!!# a=Y~<)}~<h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**ia= E'b& >V!!# a=Y~<)}~<i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**ja= E'b& >V!!# a=Y~<)}~<j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**ka= E'b& >V!!# a=Y~<)}~<k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** la= E'b& >V!!# a=Y~<)}~<l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **ma= E'b& >V!!# a=Y~<)}~<m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**na= E'b& >V!!# a=Y~<)}~<n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**oa= E'b& >V!!# a=Y~<)}~<o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**pa= E'b& >V!!# a=Y~<)}~<p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(qa= E'b& >V!!# a=Y~<)}~<q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ra= E'b& >V!!# a=Y~<)}~<r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0sa= E'b& >V!!# a=Y~<)}~<s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** ta= E'b& >V!!# a=Y~<)}~<t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** ua= E'b& >V!!# a=Y~<)}~<u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **va= E'b& >V!!# a=Y~<)}~<v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**wa= E'b& >V!!# a=Y~<)}~<w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(xa= E'b& >V!!# a=Y~<)}~<x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ybl҄= E'b& >V!!# bl҄=Y~<'`~<Tl y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2M> ten-USTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **zbl҄= E'b& >V!!# bl҄=Y~<'`~<Tl z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2M**{bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**|bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** }bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **~bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&TC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(bl҄= E'b& >V!!# bl҄=Y~<'`~<Tl  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tTC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** |= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2M> ten-US4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2M**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** |= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** |= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** |= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** |= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(|= E'b& >V!!# |=Y~<6`~<4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** }sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2M> ten-USlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **}sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2M**}sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**}sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** }sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **}sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**}sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**}sBi? E'b& >V!!# }sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3WindowsPower E'b& >V!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk--roDl=f?mMF %&**.sBi? E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0****.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@.sBi? E'b& >V!!# .sBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&lC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0YsBi? E'b& >V!!# YsBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** YsBi? E'b& >V!!# YsBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** YsBi? E'b& >V!!# YsBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **YsBi? E'b& >V!!# YsBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**YsBi? E'b& >V!!# YsBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(YsBi? E'b& >V!!# YsBi?a"?ca"?lH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tlC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 %6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.@**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0al **7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $f**07Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ndow0**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .f**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**7Ji? E'b& >V!!# 7Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**00^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(0^Ji? E'b& >V!!# 0^Ji?a"?7*a"?8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 % ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**^Ki? E'b& >V!!# ^Ki?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789a0**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(VKi? E'b& >V!!# VKi?a"?F*a"?x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 % ten-US` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789bl҄0**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** vA E'b& >V!!# vAN\|~Aw|~A`   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** vA E'b& >V!!# vAN\|~Aw|~A`   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** vA E'b& >V!!# vAN\|~Aw|~A`   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y** vA E'b& >V!!# vAN\|~Aw|~A`   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( vA E'b& >V!!# vAN\|~Aw|~A`   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(vA E'b& >V!!# vAN\|~Aw|~A`  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t` C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** >cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 % ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** >cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789|0**>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**>cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** >cA E'b& >V!!# >cAN\|~Aw|~A  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!>cA E'b& >V!!# >cAN\|~Aw|~A ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ">cA E'b& >V!!# >cAN\|~Aw|~A " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **#>cA E'b& >V!!# >cAN\|~Aw|~A # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**$>cA E'b& >V!!# >cAN\|~Aw|~A $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**%>cA E'b& >V!!# >cAN\|~Aw|~A % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**&>cA E'b& >V!!# >cAN\|~Aw|~A & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**('>cA E'b& >V!!# >cAN\|~Aw|~A ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@(>cA E'b& >V!!# >cAN\|~Aw|~A ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0)>cA E'b& >V!!# >cAN\|~Aw|~A ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** *>cA E'b& >V!!# >cAN\|~Aw|~A * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** +>cA E'b& >V!!# >cAN\|~Aw|~A + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **,>cA E'b& >V!!# >cAN\|~Aw|~A , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**->cA E'b& >V!!# >cAN\|~Aw|~A - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .