ElfFile\~ElfChnk!!L  cDl=f?mMF&**C9} E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy;**@C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.@**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** \;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0al **\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $f**0\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ndow0**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .f**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** \;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** \;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** \;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(\;} E'b& >V!!# \;}Vh , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ]<} E'b& >V!!# ]<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]<} E'b& >V!!# ]<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**]<} E'b& >V!!# ]<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**]<} E'b& >V!!# ]<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ]<} E'b& >V!!# ]<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **]<} E'b& >V!!# ]<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** &`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** &`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** &`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(&`<} E'b& >V!!# &`<}Vh\  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** !ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **!ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!ts E'b& >V!!# !tsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789O0**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0s E'b& >V!!# sjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ws E'b& >V!!# wsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ws E'b& >V!!# wsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ws E'b& >V!!# wsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ws E'b& >V!!# wsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ws E'b& >V!!# wsjele ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ;?u E'b& >V!!# ;?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **;?u E'b& >V!!# ;?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**;?u E'b& >V!!# ;?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**;?u E'b& >V!!# ;?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ;?u E'b& >V!!# ;?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** ;?u E'b& >V!!# ;?ujeme|   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** ;?u E'b& >V!!# ;?ujeme|   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** ;?u E'b& >V!!# ;?ujeme|   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 ;?u E'b& >V!!# ;?ujeme|   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890'0** ;?u E'b& >V!!# ;?ujeme|   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**;?u E'b& >V!!# ;?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(G7?u E'b& >V!!# G7?ujeme|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** au E'b& >V!!# aujele < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **au E'b& >V!!# aujele < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** au E'b& >V!!# aujele <  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!au E'b& >V!!# aujele <! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,>V E'b& >VMicrosoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk""xnDl=f?mMF8&**"au E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# aujele <" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy**#au E'b& >V!!# aujele <# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**$au E'b& >V!!# aujele <$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**%au E'b& >V!!# aujele <% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0&au E'b& >V!!# aujele <& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**'au E'b& >V!!# aujele <' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**(au E'b& >V!!# aujele <( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**)au E'b& >V!!# aujele <) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h***au E'b& >V!!# aujele <* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** +au E'b& >V!!# aujele <+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **,au E'b& >V!!# aujele <, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**-au E'b& >V!!# aujele <- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**.au E'b& >V!!# aujele <. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**/au E'b& >V!!# aujele </ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : **(0au E'b& >V!!# aujele <0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@1au E'b& >V!!# aujele <1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**02au E'b& >V!!# aujele <2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** 3au E'b& >V!!# aujele <3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** 4au E'b& >V!!# aujele <4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **5au E'b& >V!!# aujele <5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**6au E'b& >V!!# aujele <6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(7au E'b& >V!!# aujele <7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@8b(UD E'b& >V!!# b(UDgA<A8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ286Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**9b(UD E'b& >V!!# b(UDgA<A9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**:b(UD E'b& >V!!# b(UDgA<A: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**;b(UD E'b& >V!!# b(UDgA<A; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** <b(UD E'b& >V!!# b(UDgA<A< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **=b(UD E'b& >V!!# b(UDgA<A= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**>b(UD E'b& >V!!# b(UDgA<A> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**?b(UD E'b& >V!!# b(UDgA<A? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0@b(UD E'b& >V!!# b(UDgA<A@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**Ab(UD E'b& >V!!# b(UDgA<AA ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**Bb(UD E'b& >V!!# b(UDgA<AB ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**Cb(UD E'b& >V!!# b(UDgA<AC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Db(UD E'b& >V!!# b(UDgA<AD ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** Eb(UD E'b& >V!!# b(UDgA<AE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **Fb(UD E'b& >V!!# b(UDgA<AF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**Gb(UD E'b& >V!!# b(UDgA<AG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**Hb(UD E'b& >V!!# b(UDgA<AH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**Ib(UD E'b& >V!!# b(UDgA<AI ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(Jb(UD E'b& >V!!# b(UDgA<AJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@Kb(UD E'b& >V!!# b(UDgA<AK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0Lb(UD E'b& >V!!# b(UDgA<AL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Mb(UD E'b& >V!!# b(UDgA<AM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** Nb(UD E'b& >V!!# b(UDgA<AN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **Ob(UD E'b& >V!!# b(UDgA<AO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Pb(UD E'b& >V!!# b(UDgA<AP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Qb(UD E'b& >V!!# b(UDgA<AQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** R_WD E'b& >V!!# _WDgAuA$ R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **S_WD E'b& >V!!# _WDgAuA$ S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**T_WD E'b& >V!!# _WDgAuA$ T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**U_WD E'b& >V!!# _WDgAuA$ U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** V_WD E'b& >V!!# _WDgAuA$ V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **W_WD E'b& >V!!# _WDgAuA$ W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**X_WD E'b& >V!!# _WDgAuA$ X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**Y_WD E'b& >V!!# _WDgAuA$ Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0Z_WD E'b& >V!!# _WDgAuA$ Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**[_WD E'b& >V!!# _WDgAuA$ [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**\_WD E'b& >V!!# _WDgAuA$ \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**]_WD E'b& >V!!# _WDgAuA$ ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**^_WD E'b& >V!!# _WDgAuA$ ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** __WD E'b& >V!!# _WDgAuA$ _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **`_WD E'b& >V!!# _WDgAuA$ ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**a_WD E'b& >V!!# _WDgAuA$ a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**b_WD E'b& >V!!# _WDgAuA$ b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**c_WD E'b& >V!!# _WDgAuA$ c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(d_WD E'b& >V!!# _WDgAuA$ d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@e_WD E'b& >V!!# _WDgAuA$ e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0f_WD E'b& >V!!# _WDgAuA$ f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** g_WD E'b& >V!!# _WDgAuA$ g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** h_WD E'b& >V!!# _WDgAuA$ h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **i_WD E'b& >V!!# _WDgAuA$ i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**jS5bWD E'b& >V!!# S5bWDgAuA$ j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(kS5bWD E'b& >V!!# S5bWDgAuA$ k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** lXD E'b& >V!!# XDgAA \l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **mXD E'b& >V!!# XDgAA \m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**nXD E'b& >V!!# XDgAA \n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**oXD E'b& >V!!# XDgAA \o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** pXD E'b& >V!!# XDgAA \p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **qXD E'b& >V!!# XDgAA \q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**rXD E'b& >V!!# XDgAA \r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**sXD E'b& >V!!# XDgAA \s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0tXD E'b& >V!!# XDgAA \t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**uXD E'b& >V!!# XDgAA \u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**vXD E'b& >V!!# XDgAA \v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**wXD E'b& >V!!# XDgAA \w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**xXD E'b& >V!!# XDgAA \x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** yXD E'b& >V!!# XDgAA \y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **zXD E'b& >V!!# XDgAA \z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**{XD E'b& >V!!# XDgAA \{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**|XD E'b& >V!!# XDgAA \| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**}XD E'b& >V!!# XDgAA \} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(~XD E'b& >V!!# XDgAA \~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+wowerShell\v1 E'b& >VE'b!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk`!<XDDl=f?mMF&**]qv E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USxC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&xC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(v E'b& >V!!# vgAAx  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0 bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789O0** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ bv E'b& >V!!#  bvgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0g'ev E'b& >V!!# g'evgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** g'ev E'b& >V!!# g'evgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** g'ev E'b& >V!!# g'evgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **g'ev E'b& >V!!# g'evgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**g'ev E'b& >V!!# g'evgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(g'ev E'b& >V!!# g'evgAA@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy( >V!!# _WDgAuA$ ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**a_WD E'b& >V!!# _WDgAuA$ a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**b_WD E'b& >V!!# _WDgAuA$ b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**c_WD E'b& >V!!# _WDgAuA$ c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(d_WD E'b& >V!!# _WDgAuA$ d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@e_WD E'b& >V!!# _WDgAuA$ e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0f_WD E'b& >V!!# _WDgAuA$ f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** g_WD E'b& >V!!# _WDgAuA$ g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** h_WD E'b& >V!!# _WDgAuA$ h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **i_WD E'b& >V!!# _WDgAuA$ i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**jS5bWD E'b& >V!!# S5bWDgAuA$ j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(kS5bWD E'b& >V!!# S5bWDgAuA$ k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** lXD E'b& >V!!# XDgAA \l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **mXD E'b& >V!!# XDgAA \m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**nXD E'b& >V!!# XDgAA \n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**oXD E'b& >V!!# XDgAA \o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** pXD E'b& >V!!# XDgAA \p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **qXD E'b& >V!!# XDgAA \q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**rXD E'b& >V!!# XDgAA \r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**sXD E'b& >V!!# XDgAA \s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0tXD E'b& >V!!# XDgAA \t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**uXD E'b& >V!!# XDgAA \u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**vXD E'b& >V!!# XDgAA \v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**wXD E'b& >V!!# XDgAA \w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**xXD E'b& >V!!# XDgAA \x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** yXD E'b& >V!!# XDgAA \y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **zXD E'b& >V!!# XDgAA \z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**{XD E'b& >V!!# XDgAA \{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**|XD E'b& >V!!# XDgAA \| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**}XD E'b& >V!!# XDgAA \} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(~XD E'b& >V!!# XDgAA \~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(XD E'b& >V!!# XDgAA \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** ]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**]qv E'b& >V!!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+wowerShell\v1 E'b& >VE'b!# ]qvgA7ߣA< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk==/K)MDl=f?mMF&**03 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyW**@03 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&LC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**003 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 03 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 03 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **03 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**03 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(03 E'b& >V!!# 03 ddL` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.@**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0al **Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $f**0Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ndow0**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-w**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2w**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .f**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Y E'b& >V!!# Y]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&HC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(߻ E'b& >V!!# ߻]¢H  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789"@0**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(O E'b& >V!!# OF  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**  E'b& >V!!# SH   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**   E'b& >V!!# SH   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **  E'b& >V!!# SH   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!# SH   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**  E'b& >V!!# SH   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789?`/0** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-/** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2/** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** ** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&H C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( E'b& >V!!# SH  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  B'FQ E'b& >V!!# B'FQ@A, (  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!B'FQ E'b& >V!!# B'FQ@A, (! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**"B'FQ E'b& >V!!# B'FQ@A, (" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**#B'FQ E'b& >V!!# B'FQ@A, (# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** $B'FQ E'b& >V!!# B'FQ@A, ($ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **%B'FQ E'b& >V!!# B'FQ@A, (% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**&B'FQ E'b& >V!!# B'FQ@A, (& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**'B'FQ E'b& >V!!# B'FQ@A, (' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0(uFQ E'b& >V!!# uFQ@A, (( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789KS20**)uFQ E'b& >V!!# uFQ@A, () ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-2***uFQ E'b& >V!!# uFQ@A, (* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 22**+uFQ E'b& >V!!# uFQ@A, (+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**,uFQ E'b& >V!!# uFQ@A, (, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** -uFQ E'b& >V!!# uFQ@A, (- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **.uFQ E'b& >V!!# uFQ@A, (. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**/uFQ E'b& >V!!# uFQ@A, (/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**0uFQ E'b& >V!!# uFQ@A, (0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**1uFQ E'b& >V!!# uFQ@A, (1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(2uFQ E'b& >V!!# uFQ@A, (2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@3uFQ E'b& >V!!# uFQ@A, (3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**04uFQ E'b& >V!!# uFQ@A, (4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 5uFQ E'b& >V!!# uFQ@A, (5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 6uFQ E'b& >V!!# uFQ@A, (6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **7uFQ E'b& >V!!# uFQ@A, (7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**8uFQ E'b& >V!!# uFQ@A, (8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(9uFQ E'b& >V!!# uFQ@A, (9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** :pz[HQ E'b& >V!!# pz[HQ@9: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **;pz[HQ E'b& >V!!# pz[HQ@9; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**<pz[HQ E'b& >V!!# pz[HQ@9< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**=pz[HQ E'b& >V!!# pz[HQ@9= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,>V E'b& >VMicrosoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk>>x?ђDl=f?mMF8&**>pz[HQ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# pz[HQ@9> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy**?pz[HQ E'b& >V!!# pz[HQ@9? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**@pz[HQ E'b& >V!!# pz[HQ@9@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**Apz[HQ E'b& >V!!# pz[HQ@9A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0Bpz[HQ E'b& >V!!# pz[HQ@9B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**Cpz[HQ E'b& >V!!# pz[HQ@9C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**Dl[HQ E'b& >V!!# l[HQ@9D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**El[HQ E'b& >V!!# l[HQ@9E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Fl[HQ E'b& >V!!# l[HQ@9F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** Gl[HQ E'b& >V!!# l[HQ@9G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Hl[HQ E'b& >V!!# l[HQ@9H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Il[HQ E'b& >V!!# l[HQ@9I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Jl[HQ E'b& >V!!# l[HQ@9J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Kl[HQ E'b& >V!!# l[HQ@9K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Ll[HQ E'b& >V!!# l[HQ@9L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@Ml[HQ E'b& >V!!# l[HQ@9M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0Nl[HQ E'b& >V!!# l[HQ@9N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** Ol[HQ E'b& >V!!# l[HQ@9O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** Pl[HQ E'b& >V!!# l[HQ@9P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **Ql[HQ E'b& >V!!# l[HQ@9Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**Rl[HQ E'b& >V!!# l[HQ@9R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(Sl[HQ E'b& >V!!# l[HQ@9S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@TWIQ E'b& >V!!# WIQ@ T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ286Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**UIQ E'b& >V!!# IQ@ U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**VIQ E'b& >V!!# IQ@ V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**WIQ E'b& >V!!# IQ@ W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** XIQ E'b& >V!!# IQ@ X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **YIQ E'b& >V!!# IQ@ Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ZIQ E'b& >V!!# IQ@ Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**[IQ E'b& >V!!# IQ@ [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0\IQ E'b& >V!!# IQ@ \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**]IQ E'b& >V!!# IQ@ ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**^IQ E'b& >V!!# IQ@ ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**_IQ E'b& >V!!# IQ@ _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**`IQ E'b& >V!!# IQ@ ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** aIQ E'b& >V!!# IQ@ a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **bIQ E'b& >V!!# IQ@ b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**cIQ E'b& >V!!# IQ@ c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**dIQ E'b& >V!!# IQ@ d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**eIQ E'b& >V!!# IQ@ e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(fIQ E'b& >V!!# IQ@ f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@gIQ E'b& >V!!# IQ@ g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0hIQ E'b& >V!!# IQ@ h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** iIQ E'b& >V!!# IQ@ i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** jIQ E'b& >V!!# IQ@ j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **kIQ E'b& >V!!# IQ@ k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**lIQ E'b& >V!!# IQ@ l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(mIQ E'b& >V!!# IQ@ m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** n* E'b& >V!!# *CfvUvln ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **o* E'b& >V!!# *CfvUvlo ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**p* E'b& >V!!# *CfvUvlp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**q* E'b& >V!!# *CfvUvlq ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** r* E'b& >V!!# *CfvUvlr ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **s* E'b& >V!!# *CfvUvls ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**t* E'b& >V!!# *CfvUvlt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**u* E'b& >V!!# *CfvUvlu ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0v* E'b& >V!!# *CfvUvlv ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**w* E'b& >V!!# *CfvUvlw ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**x* E'b& >V!!# *CfvUvlx ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**y* E'b& >V!!# *CfvUvly ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**z* E'b& >V!!# *CfvUvlz ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** {* E'b& >V!!# *CfvUvl{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **|* E'b& >V!!# *CfvUvl| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**}* E'b& >V!!# *CfvUvl} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**~* E'b& >V!!# *CfvUvl~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w*** E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(* E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@* E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0* E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** * E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** * E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe *** E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6*** E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(* E'b& >V!!# *CfvUvl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(b E'b& >V!!# bCfvlv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-USd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy ** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0 E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3**  E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow ** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+wowerShell\v1 E'b& >VE'b!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk%%mBTCVDl=f?mMF&** E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&d C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( E'b& >V!!# Cfvvd  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** ߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**߽_ E'b& >V!!# ߽_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@D_ E'b& >V!!# D_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0k_ E'b& >V!!# k_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** k_ E'b& >V!!# k_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** k_ E'b& >V!!# k_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **k_ E'b& >V!!# k_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**k_ E'b& >V!!# k_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(k_ E'b& >V!!# k_=RZ҉hZ҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**09b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789k0**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&LC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**09b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**9b E'b& >V!!# 9b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( :b E'b& >V!!#  :b=RZ҉ZZ҉L  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** *b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** *b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0*b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .***b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** *b E'b& >V!!# *b=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Qb E'b& >V!!# Qb=RZ҉Z҉ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( Qb E'b& >V!!# Qb=RZ҉Z҉  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  Cc E'b& >V!!# Ccy-y-$  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **!Cc E'b& >V!!# Ccy-y-$ ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**"Cc E'b& >V!!# Ccy-y-$ " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(#Cc E'b& >V!!# Ccy-y-$ # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** $O c E'b& >V!!# O cy-7y-H $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **%O c E'b& >V!!# O cy-7y-H % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 > E'b& >V 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk&&p:NJkDl=f?mMF5<&**&O c E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# O cy-7y-H & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**'O c E'b& >V!!# O cy-7y-H ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** (O c E'b& >V!!# O cy-7y-H ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **)O c E'b& >V!!# O cy-7y-H ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0***O c E'b& >V!!# O cy-7y-H * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**+O c E'b& >V!!# O cy-7y-H + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0,O c E'b& >V!!# O cy-7y-H , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**-O c E'b& >V!!# O cy-7y-H - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**.O c E'b& >V!!# O cy-7y-H . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**/O c E'b& >V!!# O cy-7y-H / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**0O c E'b& >V!!# O cy-7y-H 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** 1O c E'b& >V!!# O cy-7y-H 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **2O c E'b& >V!!# O cy-7y-H 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**3O c E'b& >V!!# O cy-7y-H 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**4O c E'b& >V!!# O cy-7y-H 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**5O c E'b& >V!!# O cy-7y-H 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : **(6O c E'b& >V!!# O cy-7y-H 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@7O c E'b& >V!!# O cy-7y-H 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&H C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**08O c E'b& >V!!# O cy-7y-H 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** 9O c E'b& >V!!# O cy-7y-H 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** :O c E'b& >V!!# O cy-7y-H : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **;O c E'b& >V!!# O cy-7y-H ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**<O c E'b& >V!!# O cy-7y-H < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(=O c E'b& >V!!# O cy-7y-H = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tH C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@> nc E'b& >V!!#  ncy-y-X > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25<6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**? nc E'b& >V!!#  ncy-y-X ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**@ nc E'b& >V!!#  ncy-y-X @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**A nc E'b& >V!!#  ncy-y-X A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** B nc E'b& >V!!#  ncy-y-X B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **C nc E'b& >V!!#  ncy-y-X C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**DQc E'b& >V!!# Qcy-y-X D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**EQc E'b& >V!!# Qcy-y-X E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0FQc E'b& >V!!# Qcy-y-X F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**GQc E'b& >V!!# Qcy-y-X G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**HQc E'b& >V!!# Qcy-y-X H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**IQc E'b& >V!!# Qcy-y-X I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**JQc E'b& >V!!# Qcy-y-X J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** KQc E'b& >V!!# Qcy-y-X K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **LQc E'b& >V!!# Qcy-y-X L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**MQc E'b& >V!!# Qcy-y-X M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**NQc E'b& >V!!# Qcy-y-X N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**OQc E'b& >V!!# Qcy-y-X O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(PQc E'b& >V!!# Qcy-y-X P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@QQc E'b& >V!!# Qcy-y-X Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0RQc E'b& >V!!# Qcy-y-X R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** SQc E'b& >V!!# Qcy-y-X S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** TQc E'b& >V!!# Qcy-y-X T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **UQc E'b& >V!!# Qcy-y-X U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**VQc E'b& >V!!# Qcy-y-X V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(WQc E'b& >V!!# Qcy-y-X W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** X3 ǎ E'b& >V!!# 3 ǎv.~d X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-USd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **Y3 ǎ E'b& >V!!# 3 ǎv.~d Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Z3 ǎ E'b& >V!!# 3 ǎv.~d Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**[3 ǎ E'b& >V!!# 3 ǎv.~d [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** \3 ǎ E'b& >V!!# 3 ǎv.~d \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **]3 ǎ E'b& >V!!# 3 ǎv.~d ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**^3 ǎ E'b& >V!!# 3 ǎv.~d ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**_3 ǎ E'b& >V!!# 3 ǎv.~d _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0`~ ǎ E'b& >V!!# ~ ǎv.~d ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**a~ ǎ E'b& >V!!# ~ ǎv.~d a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**b~ ǎ E'b& >V!!# ~ ǎv.~d b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**c~ ǎ E'b& >V!!# ~ ǎv.~d c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**d~ ǎ E'b& >V!!# ~ ǎv.~d d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** e~ ǎ E'b& >V!!# ~ ǎv.~d e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **f~ ǎ E'b& >V!!# ~ ǎv.~d f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**g~ ǎ E'b& >V!!# ~ ǎv.~d g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**h~ ǎ E'b& >V!!# ~ ǎv.~d h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**i~ ǎ E'b& >V!!# ~ ǎv.~d i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(j~ ǎ E'b& >V!!# ~ ǎv.~d j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@k~ ǎ E'b& >V!!# ~ ǎv.~d k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&d C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0lc ǎ E'b& >V!!# c ǎv.~d l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** mc ǎ E'b& >V!!# c ǎv.~d m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** nc ǎ E'b& >V!!# c ǎv.~d n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **oc ǎ E'b& >V!!# c ǎv.~d o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**pc ǎ E'b& >V!!# c ǎv.~d p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(qc ǎ E'b& >V!!# c ǎv.~d q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** r~ǎ E'b& >V!!# ~ǎvA~@ r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **s~ǎ E'b& >V!!# ~ǎvA~@ s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**t~ǎ E'b& >V!!# ~ǎvA~@ t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**u~ǎ E'b& >V!!# ~ǎvA~@ u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** v~ǎ E'b& >V!!# ~ǎvA~@ v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **w~ǎ E'b& >V!!# ~ǎvA~@ w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**x~ǎ E'b& >V!!# ~ǎvA~@ x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**y~ǎ E'b& >V!!# ~ǎvA~@ y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0zB~ǎ E'b& >V!!# B~ǎvA~@ z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**{B~ǎ E'b& >V!!# B~ǎvA~@ { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**|B~ǎ E'b& >V!!# B~ǎvA~@ | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**}B~ǎ E'b& >V!!# B~ǎvA~@ } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**~B~ǎ E'b& >V!!# B~ǎvA~@ ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(B~ǎ E'b& >V!!# B~ǎvA~@  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t@ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**GX9ǎ E'b& >V!!# GX9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** _9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow owerShell\v1 E'b& >VE'b!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk 9pHDl=f?mMF"&**_9ǎ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** _9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** _9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(_9ǎ E'b& >V!!# _9ǎv  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@e* E'b& >V!!# e*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2"6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ˌ* E'b& >V!!# ˌ*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(׳* E'b& >V!!# ׳*ɥҥ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789U0**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(u* E'b& >V!!# u*ɥmX  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** .* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-US4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** .* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789o0**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** .* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@.* E'b& >V!!# .*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0/* E'b& >V!!# /*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** /* E'b& >V!!# /*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** /* E'b& >V!!# /*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **/* E'b& >V!!# /*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**/* E'b& >V!!# /*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(/* E'b& >V!!# /*ɥ{4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t4C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-US|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**($v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0$v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( $v E'b& >V!!# $v JO@pO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkpmu=ǧDl=f?mMF& **&v E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿W0$DD EventDataA=loData= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe**(&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . .Ŀ[9TDA)l= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r(**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,r** &v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0?w **&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0I**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $c**0&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ft-W0**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-W**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2W**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .c**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,W** &v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**&v E'b& >V!!# &v JO@gOO@| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**( &v E'b& >V!!# &v JO@gOO@|  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@!&v E'b& >V!!# &v JO@gOO@|! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0"&v E'b& >V!!# &v JO@gOO@|" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** #&v E'b& >V!!# &v JO@gOO@|# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** $&v E'b& >V!!# &v JO@gOO@|$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **%&v E'b& >V!!# &v JO@gOO@|% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**&&v E'b& >V!!# &v JO@gOO@|& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**('&v E'b& >V!!# &v JO@gOO@|' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** (q'v E'b& >V!!# q'v JO@wOO@x ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USxC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **)q'v E'b& >V!!# q'v JO@wOO@x ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2***q'v E'b& >V!!# q'v JO@wOO@x * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**+q'v E'b& >V!!# q'v JO@wOO@x + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ,q'v E'b& >V!!# q'v JO@wOO@x , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **-q'v E'b& >V!!# q'v JO@wOO@x - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**.q'v E'b& >V!!# q'v JO@wOO@x . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**/q'v E'b& >V!!# q'v JO@wOO@x / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**00q'v E'b& >V!!# q'v JO@wOO@x 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**1q'v E'b& >V!!# q'v JO@wOO@x 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**2q'v E'b& >V!!# q'v JO@wOO@x 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**3q'v E'b& >V!!# q'v JO@wOO@x 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**4q'v E'b& >V!!# q'v JO@wOO@x 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** 5q'v E'b& >V!!# q'v JO@wOO@x 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **6q'v E'b& >V!!# q'v JO@wOO@x 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**7q'v E'b& >V!!# q'v JO@wOO@x 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**8q'v E'b& >V!!# q'v JO@wOO@x 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**9q'v E'b& >V!!# q'v JO@wOO@x 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(:q'v E'b& >V!!# q'v JO@wOO@x : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@;q'v E'b& >V!!# q'v JO@wOO@x ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&xC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0<q'v E'b& >V!!# q'v JO@wOO@x < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** =q'v E'b& >V!!# q'v JO@wOO@x = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** >q'v E'b& >V!!# q'v JO@wOO@x > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **?q'v E'b& >V!!# q'v JO@wOO@x ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**@q'v E'b& >V!!# q'v JO@wOO@x @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Aq'v E'b& >V!!# q'v JO@wOO@x A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . txC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** Bٕ E'b& >V!!# ٕI $u < B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **Cٕ E'b& >V!!# ٕI $u < C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Dٕ E'b& >V!!# ٕI $u < D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Eٕ E'b& >V!!# ٕI $u < E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Fٕ E'b& >V!!# ٕI $u < F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **Gٕ E'b& >V!!# ٕI $u < G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Hٕ E'b& >V!!# ٕI $u < H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**Iٕ E'b& >V!!# ٕI $u < I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0Jٕ E'b& >V!!# ٕI $u < J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**Kٕ E'b& >V!!# ٕI $u < K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**Lٕ E'b& >V!!# ٕI $u < L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**Mٕ E'b& >V!!# ٕI $u < M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Nٕ E'b& >V!!# ٕI $u < N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** Oٕ E'b& >V!!# ٕI $u < O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **Pٕ E'b& >V!!# ٕI $u < P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**Qٕ E'b& >V!!# ٕI $u < Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**Rٕ E'b& >V!!# ٕI $u < R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**Sٕ E'b& >V!!# ٕI $u < S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(Tٕ E'b& >V!!# ٕI $u < T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@Uٕ E'b& >V!!# ٕI $u < U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0Vٕ E'b& >V!!# ٕI $u < V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Wٕ E'b& >V!!# ٕI $u < W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** Xٕ E'b& >V!!# ٕI $u < X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **Yٕ E'b& >V!!# ٕI $u < Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Zٕ E'b& >V!!# ٕI $u < Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**([ٕ E'b& >V!!# ٕI $u < [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t<C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** \^ٕ E'b& >V!!# ^ٕI EQ |\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **]^ٕ E'b& >V!!# ^ٕI EQ |] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**^^ٕ E'b& >V!!# ^ٕI EQ |^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**_^ٕ E'b& >V!!# ^ٕI EQ |_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** `^ٕ E'b& >V!!# ^ٕI EQ |` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **a^ٕ E'b& >V!!# ^ٕI EQ |a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**b^ٕ E'b& >V!!# ^ٕI EQ |b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**c^ٕ E'b& >V!!# ^ٕI EQ |c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0d^ٕ E'b& >V!!# ^ٕI EQ |d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**e^ٕ E'b& >V!!# ^ٕI EQ |e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**f^ٕ E'b& >V!!# ^ٕI EQ |f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**g^ٕ E'b& >V!!# ^ٕI EQ |g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**h^ٕ E'b& >V!!# ^ٕI EQ |h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** i^ٕ E'b& >V!!# ^ٕI EQ |i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **j^ٕ E'b& >V!!# ^ٕI EQ |j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**k^ٕ E'b& >V!!# ^ٕI EQ |k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**l^ٕ E'b& >V!!# ^ٕI EQ |l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**m^ٕ E'b& >V!!# ^ٕI EQ |m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(n^ٕ E'b& >V!!# ^ٕI EQ |n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@o^ٕ E'b& >V!!# ^ٕI EQ |o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0p^ٕ E'b& >V!!# ^ٕI EQ |p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** q^ٕ E'b& >V!!# ^ٕI EQ |q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** r^ٕ E'b& >V!!# ^ٕI EQ |r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **s^ٕ E'b& >V!!# ^ٕI EQ |s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**t^ٕ E'b& >V!!# ^ٕI EQ |t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(u^ٕ E'b& >V!!# ^ٕI EQ |u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** v)ٕ E'b& >V!!# )ٕI PQ v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **w)ٕ E'b& >V!!# )ٕI PQ w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**x)ٕ E'b& >V!!# )ٕI PQ x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**y)ٕ E'b& >V!!# )ٕI PQ y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** z)ٕ E'b& >V!!# )ٕI PQ z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **{)ٕ E'b& >V!!# )ٕI PQ { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**|ٕ E'b& >V!!# ٕI PQ | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**}ٕ E'b& >V!!# ٕI PQ } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0~ٕ E'b& >V!!# ٕI PQ ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .hl\v1.0\power E'b& >VE'b!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnk4c35Dl=f?mMF%'&**ٕ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l.** ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0l **ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1i**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+i**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /i**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :r**(ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyal(**@ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyt-Wi@**0ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tttern0** ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMndow ** ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMs-In **ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6n**ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0n**(ٕ E'b& >V!!# ٕI PQ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyo(**@9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%'6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**09= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789&0**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-&**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2&**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**09= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** 9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(9= E'b& >V!!# 9=^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789q'0**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-'**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2'**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(d= E'b& >V!!# d=)  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(qf= E'b& >V!!# qf=9 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** z^ E'b& >V!!# z^% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789^0**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkiiGJDl=f?mMF &**` E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0l.**(` E'b& >V!!# `% RR$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** @U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** @U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h** @U E'b& >V!!# @U% R2R   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**( @U E'b& >V!!# @U% R2R   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ @U E'b& >V!!# @U% R2R   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0 @U E'b& >V!!# @U% R2R   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670**  @U E'b& >V!!# @U% R2R   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** @U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2& **@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(@U E'b& >V!!# @U% R2R  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**07J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** 7J E'b& >V!!# 7J% RR p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh ** 7J E'b& >V!!# 7J% RR p  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**!7J E'b& >V!!# 7J% RR p! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**"7J E'b& >V!!# 7J% RR p" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**#7J E'b& >V!!# 7J% RR p# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**($7J E'b& >V!!# 7J% RR p$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@%7J E'b& >V!!# 7J% RR p% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0&7J E'b& >V!!# 7J% RR p& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** '7J E'b& >V!!# 7J% RR p' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** (7J E'b& >V!!# 7J% RR p( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2' **)7J E'b& >V!!# 7J% RR p) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6***7J E'b& >V!!# 7J% RR p* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(+7J E'b& >V!!# 7J% RR p+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ,t E'b& >V!!# t-AA0, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **-t E'b& >V!!# t-AA0- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**.t E'b& >V!!# t-AA0. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**/t E'b& >V!!# t-AA0/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 0t E'b& >V!!# t-AA00 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **1t E'b& >V!!# t-AA01 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**2t E'b& >V!!# t-AA02 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**3t E'b& >V!!# t-AA03 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**04t E'b& >V!!# t-AA04 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**5t E'b& >V!!# t-AA05 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**6t E'b& >V!!# t-AA06 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**7t E'b& >V!!# t-AA07 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**8t E'b& >V!!# t-AA08 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** 9t E'b& >V!!# t-AA09 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **:t E'b& >V!!# t-AA0: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**;t E'b& >V!!# t-AA0; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**<t E'b& >V!!# t-AA0< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**= u E'b& >V!!#  u-AA0= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(> u E'b& >V!!#  u-AA0> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@? u E'b& >V!!#  u-AA0? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0@ u E'b& >V!!#  u-AA0@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** A u E'b& >V!!#  u-AA0A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** B u E'b& >V!!#  u-AA0B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **C u E'b& >V!!#  u-AA0C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**D u E'b& >V!!#  u-AA0D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(E u E'b& >V!!#  u-AA0E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** F E'b& >V!!# -AB F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **GE E'b& >V!!# E-AB G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**HE E'b& >V!!# E-AB H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**IE E'b& >V!!# E-AB I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** JE E'b& >V!!# E-AB J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **KE E'b& >V!!# E-AB K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**LE E'b& >V!!# E-AB L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**ME E'b& >V!!# E-AB M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0NE E'b& >V!!# E-AB N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**OE E'b& >V!!# E-AB O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**PE E'b& >V!!# E-AB P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**QE E'b& >V!!# E-AB Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**RE E'b& >V!!# E-AB R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** SE E'b& >V!!# E-AB S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **TE E'b& >V!!# E-AB T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**UE E'b& >V!!# E-AB U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**VE E'b& >V!!# E-AB V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**WE E'b& >V!!# E-AB W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(XE E'b& >V!!# E-AB X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@YE E'b& >V!!# E-AB Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0ZE E'b& >V!!# E-AB Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** [E E'b& >V!!# E-AB [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** \E E'b& >V!!# E-AB \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **]E E'b& >V!!# E-AB ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**^E E'b& >V!!# E-AB ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(_E E'b& >V!!# E-AB _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** `:s E'b& >V!!# :s-A B\ ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **a:s E'b& >V!!# :s-A B\ a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**b:s E'b& >V!!# :s-A B\ b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**c:s E'b& >V!!# :s-A B\ c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** d:s E'b& >V!!# :s-A B\ d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **e:s E'b& >V!!# :s-A B\ e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**f:s E'b& >V!!# :s-A B\ f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**g:s E'b& >V!!# :s-A B\ g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0h:s E'b& >V!!# :s-A B\ h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**ias E'b& >V!!# as-A B\ i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0owershell.ex E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkjjERDl=f?mMFU+&**jas E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# as-A B\ j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2l.**kas E'b& >V!!# as-A B\ k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**las E'b& >V!!# as-A B\ l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** mas E'b& >V!!# as-A B\ m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **nas E'b& >V!!# as-A B\ n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**oas E'b& >V!!# as-A B\ o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**pas E'b& >V!!# as-A B\ p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**qas E'b& >V!!# as-A B\ q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(ras E'b& >V!!# as-A B\ r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@sas E'b& >V!!# as-A B\ s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0tas E'b& >V!!# as-A B\ t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** uas E'b& >V!!# as-A B\ u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** vas E'b& >V!!# as-A B\ v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **was E'b& >V!!# as-A B\ w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**xas E'b& >V!!# as-A B\ x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(yas E'b& >V!!# as-A B\ y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@zMO E'b& >V!!# MOU [ z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**{MO E'b& >V!!# MOU [ { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**|MO E'b& >V!!# MOU [ | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**}MO E'b& >V!!# MOU [ } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ~MO E'b& >V!!# MOU [ ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **MO E'b& >V!!# MOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**MO E'b& >V!!# MOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**MO E'b& >V!!# MOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567892&0**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0tO E'b& >V!!# tOU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** O E'b& >V!!# OU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** O E'b& >V!!# OU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **O E'b& >V!!# OU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**O E'b& >V!!# OU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(O E'b& >V!!# OU [  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**X?O E'b& >V!!# X?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567892'0**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** ?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(?O E'b& >V!!# ?OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** 'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**('O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0'O E'b& >V!!# 'OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** O E'b& >V!!# OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** O E'b& >V!!# OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **O E'b& >V!!# OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**O E'b& >V!!# OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(O E'b& >V!!# OU   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** \7 E'b& >V!!# \7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **\7 E'b& >V!!# \7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**\7 E'b& >V!!# \7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**\7 E'b& >V!!# \7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** `7 E'b& >V!!# `7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **`7 E'b& >V!!# `7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**`7 E'b& >V!!# `7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**`7 E'b& >V!!# `7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** l7 E'b& >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b&  E'b& >VV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkQQpq%HDl=f?mMF&**l7 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# l7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM.**{ 7 E'b& >V!!# { 7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**{ 7 E'b& >V!!# { 7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**({ 7 E'b& >V!!# { 7&e&e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**v9 E'b& >V!!# v9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**09 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** 9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** 9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(9 E'b& >V!!# 9&e&e  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** +: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **+: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**+: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**+: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** +: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **+: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**+: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**+: E'b& >V!!# +:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w**  /: E'b& >V!!# /:&e&ex  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh ** /: E'b& >V!!# /:&e&ex  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h** /: E'b& >V!!# /:&e&ex  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** /: E'b& >V!!# /:&e&ex  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h** /: E'b& >V!!# /:&e&ex  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** /: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** /: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(/: E'b& >V!!# /:&e&ex ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**f E'b& >V!!# fb^^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0** f E'b& >V!!# fb^^  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**!f E'b& >V!!# fb^^! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**"f E'b& >V!!# fb^^" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** #f E'b& >V!!# fb^^# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **$f E'b& >V!!# fb^^$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**%f E'b& >V!!# fb^^% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**&f E'b& >V!!# fb^^& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**'f E'b& >V!!# fb^^' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**((f E'b& >V!!# fb^^( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@)f E'b& >V!!# fb^^) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0*f E'b& >V!!# fb^^* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** +f E'b& >V!!# fb^^+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ,f E'b& >V!!# fb^^, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **-f E'b& >V!!# fb^^- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**.f E'b& >V!!# fb^^. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(/f E'b& >V!!# fb^^/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 0l E'b& >V!!# lb^'^ 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **1l E'b& >V!!# lb^'^ 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**2l E'b& >V!!# lb^'^ 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**3l E'b& >V!!# lb^'^ 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 4l E'b& >V!!# lb^'^ 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **5l E'b& >V!!# lb^'^ 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**6l E'b& >V!!# lb^'^ 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**7l E'b& >V!!# lb^'^ 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**08l E'b& >V!!# lb^'^ 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**9l E'b& >V!!# lb^'^ 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**:l E'b& >V!!# lb^'^ : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**;l E'b& >V!!# lb^'^ ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**<l E'b& >V!!# lb^'^ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** =l E'b& >V!!# lb^'^ = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **>l E'b& >V!!# lb^'^ > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**?l E'b& >V!!# lb^'^ ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**@l E'b& >V!!# lb^'^ @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**Al E'b& >V!!# lb^'^ A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(Bl E'b& >V!!# lb^'^ B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@Cl E'b& >V!!# lb^'^ C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0Dl E'b& >V!!# lb^'^ D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** El E'b& >V!!# lb^'^ E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** Fl E'b& >V!!# lb^'^ F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **Gl E'b& >V!!# lb^'^ G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**Hl E'b& >V!!# lb^'^ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(Il E'b& >V!!# lb^'^ I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** J(ћ E'b& >V!!# (ћb^4^LJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **K(ћ E'b& >V!!# (ћb^4^LK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**L(ћ E'b& >V!!# (ћb^4^LL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**M(ћ E'b& >V!!# (ћb^4^LM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** N(ћ E'b& >V!!# (ћb^4^LN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **O(ћ E'b& >V!!# (ћb^4^LO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**P(ћ E'b& >V!!# (ћb^4^LP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**Q(ћ E'b& >V!!# (ћb^4^LQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\.0\powershel E'b& >V!# (ћb^4^LR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkRRxãkDl=f?mMF/&**R(ћ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# (ћb^4^LR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789**S(ћ E'b& >V!!# (ћb^4^LS ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**T(ћ E'b& >V!!# (ћb^4^LT ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**U(ћ E'b& >V!!# (ћb^4^LU ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**V(ћ E'b& >V!!# (ћb^4^LV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** W(ћ E'b& >V!!# (ћb^4^LW ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ter **X(ћ E'b& >V!!# (ћb^4^LX ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1r**Y(ћ E'b& >V!!# (ћb^4^LY ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+r**Z(ћ E'b& >V!!# (ћb^4^LZ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /r**[(ћ E'b& >V!!# (ћb^4^L[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :I**(\(ћ E'b& >V!!# (ћb^4^L\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyti(**@](ћ E'b& >V!!# (ћb^4^L] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyosof@**0^(ћ E'b& >V!!# (ћb^4^L^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tts-In0** _(ћ E'b& >V!!# (ћb^4^L_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMt-Wi ** `(ћ E'b& >V!!# (ћb^4^L` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMndow **a(ћ E'b& >V!!# (ћb^4^La ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6w**b(ћ E'b& >V!!# (ћb^4^Lb ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0w**(c(ћ E'b& >V!!# (ћb^4^Lc ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyn(**@d;^qb E'b& >V!!# ;^qbm d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**eG_qb E'b& >V!!# G_qbm e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**fG_qb E'b& >V!!# G_qbm f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**gG_qb E'b& >V!!# G_qbm g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** hG_qb E'b& >V!!# G_qbm h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **iG_qb E'b& >V!!# G_qbm i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**jG_qb E'b& >V!!# G_qbm j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**kG_qb E'b& >V!!# G_qbm k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0l[/_qb E'b& >V!!# [/_qbm l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**m[/_qb E'b& >V!!# [/_qbm m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**n[/_qb E'b& >V!!# [/_qbm n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**o[/_qb E'b& >V!!# [/_qbm o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**p[/_qb E'b& >V!!# [/_qbm p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** q[/_qb E'b& >V!!# [/_qbm q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **r[/_qb E'b& >V!!# [/_qbm r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**s[/_qb E'b& >V!!# [/_qbm s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**t[/_qb E'b& >V!!# [/_qbm t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**u[/_qb E'b& >V!!# [/_qbm u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(v[/_qb E'b& >V!!# [/_qbm v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@w[/_qb E'b& >V!!# [/_qbm w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0x[/_qb E'b& >V!!# [/_qbm x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** y[/_qb E'b& >V!!# [/_qbm y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** z[/_qb E'b& >V!!# [/_qbm z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **{[/_qb E'b& >V!!# [/_qbm { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**|[/_qb E'b& >V!!# [/_qbm | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(}[/_qb E'b& >V!!# [/_qbm } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ~sb E'b& >V!!# sb` ` ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(sb E'b& >V!!# sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(,sb E'b& >V!!# ,sb` `  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789-0**pUtb E'b& >V!!# pUtbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Utb E'b& >V!!# Utbp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-USXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**i E'b& >V!!# iIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Cj E'b& >V!!# CjIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789G0**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** )j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**()j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@ E'b& >VLR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk997Dl=f?mMF&**)j E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt** )j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** )j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMU **)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**)j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**()j E'b& >V!!# )jIvwkvwXL  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@'Ύ E'b& >V!!# 'ΎIvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exes-In@**'Ύ E'b& >V!!# 'ΎIvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2n**'Ύ E'b& >V!!# 'ΎIvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .n**'Ύ E'b& >V!!# 'ΎIvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,n**  E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow ** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0r** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $I**0 E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789nati0** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .I** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l**  E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 ** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**( E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0 E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** **  E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMo ** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( E'b& >V!!# IvwUvw( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyq(** 1 E'b& >V!!# 1Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **1 E'b& >V!!# 1Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**1 E'b& >V!!# 1Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**1 E'b& >V!!# 1Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0[/_q **i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(i2 E'b& >V!!# i2Ivwvw$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyys(** + E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** + E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0,s **+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0** + E'b& >V!!# +ӪaӪp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h** + E'b& >V!!# +ӪaӪp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** + E'b& >V!!# +ӪaӪp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h** + E'b& >V!!# +ӪaӪp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**  + E'b& >V!!# +ӪaӪp  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt-0** + E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** + E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(+ E'b& >V!!# +ӪaӪp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyt(** +6 E'b& >V!!# +6ӪsӪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **+6 E'b& >V!!# +6ӪsӪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**+6 E'b& >V!!# +6ӪsӪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**+6 E'b& >V!!# +6ӪsӪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** +6 E'b& >V!!# +6ӪsӪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0Ut **+6 E'b& >V!!# +6ӪsӪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y** +6 E'b& >V!!# +6ӪsӪ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!+6 E'b& >V!!# +6ӪsӪ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0"+6 E'b& >V!!# +6ӪsӪ" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**#+6 E'b& >V!!# +6ӪsӪ# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**$+6 E'b& >V!!# +6ӪsӪ$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**%+6 E'b& >V!!# +6ӪsӪ% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**&+6 E'b& >V!!# +6ӪsӪ& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** '+6 E'b& >V!!# +6ӪsӪ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **(+6 E'b& >V!!# +6ӪsӪ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**)+6 E'b& >V!!# +6ӪsӪ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0***+6 E'b& >V!!# +6ӪsӪ* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**++6 E'b& >V!!# +6ӪsӪ+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(,+6 E'b& >V!!# +6ӪsӪ, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@-+6 E'b& >V!!# +6ӪsӪ- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0.+6 E'b& >V!!# +6ӪsӪ. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttG0** /+6 E'b& >V!!# +6ӪsӪ/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** 0+6 E'b& >V!!# +6ӪsӪ0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **1+6 E'b& >V!!# +6ӪsӪ1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**2+6 E'b& >V!!# +6ӪsӪ2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(3+6 E'b& >V!!# +6ӪsӪ3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 44 E'b& >V!!# 4ӪӪt ( 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **54 E'b& >V!!# 4ӪӪt ( 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**64 E'b& >V!!# 4ӪӪt ( 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**74 E'b& >V!!# 4ӪӪt ( 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 84 E'b& >V!!# 4ӪӪt ( 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0)j **94 E'b& >V!!# 4ӪӪt ( 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y@ E'b& >V>VLR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk::po׆Dl=f?mMF3&**:4 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# 4ӪӪt ( : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0m:**;4 E'b& >V!!# 4ӪӪt ( ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0<4 E'b& >V!!# 4ӪӪt ( < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**=4 E'b& >V!!# 4ӪӪt ( = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**>4 E'b& >V!!# 4ӪӪt ( > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**?4 E'b& >V!!# 4ӪӪt ( ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**@4 E'b& >V!!# 4ӪӪt ( @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** A4 E'b& >V!!# 4ӪӪt ( A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0t-W **B4 E'b& >V!!# 4ӪӪt ( B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1W**C4 E'b& >V!!# 4ӪӪt ( C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+W**D4 E'b& >V!!# 4ӪӪt ( D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /W**E4 E'b& >V!!# 4ӪӪt ( E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :o**(F4 E'b& >V!!# 4ӪӪt ( F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyydo(**@G4 E'b& >V!!# 4ӪӪt ( G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy+:Wc@**0H4 E'b& >V!!# 4ӪӪt ( H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttosof0** I4 E'b& >V!!# 4ӪӪt ( I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM.?w ** J4 E'b& >V!!# 4ӪӪt ( J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMMicr **K4 E'b& >V!!# 4ӪӪt ( K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6r**L4 E'b& >V!!# 4ӪӪt ( L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0r**(M4 E'b& >V!!# 4ӪӪt ( M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyi(**@Nt E'b& >V!!# ta.i.4N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ236Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**Ot E'b& >V!!# ta.i.4O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Pt E'b& >V!!# ta.i.4P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Qt E'b& >V!!# ta.i.4Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Rt E'b& >V!!# ta.i.4R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **St E'b& >V!!# ta.i.4S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Tt E'b& >V!!# ta.i.4T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **Ut E'b& >V!!# ta.i.4U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0Vt E'b& >V!!# ta.i.4V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**Wt E'b& >V!!# ta.i.4W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**Xt E'b& >V!!# ta.i.4X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Yt E'b& >V!!# ta.i.4Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Zt E'b& >V!!# ta.i.4Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** [t E'b& >V!!# ta.i.4[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **\t E'b& >V!!# ta.i.4\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**]t E'b& >V!!# ta.i.4] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**^t E'b& >V!!# ta.i.4^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**_t E'b& >V!!# ta.i.4_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(`t E'b& >V!!# ta.i.4` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@at E'b& >V!!# ta.i.4a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyi2@**0bt E'b& >V!!# ta.i.4b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tti20** ct E'b& >V!!# ta.i.4c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** dt E'b& >V!!# ta.i.4d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **et E'b& >V!!# ta.i.4e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ft E'b& >V!!# ta.i.4f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(gt E'b& >V!!# ta.i.4g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** hOt E'b& >V!!# Ota.i.x h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-USx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **iOt E'b& >V!!# Ota.i.x i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**jOt E'b& >V!!# Ota.i.x j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**kOt E'b& >V!!# Ota.i.x k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** lOt E'b& >V!!# Ota.i.x l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **mOt E'b& >V!!# Ota.i.x m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**nOt E'b& >V!!# Ota.i.x n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **oOt E'b& >V!!# Ota.i.x o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0pOt E'b& >V!!# Ota.i.x p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**qOt E'b& >V!!# Ota.i.x q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**rOt E'b& >V!!# Ota.i.x r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**sOt E'b& >V!!# Ota.i.x s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**tOt E'b& >V!!# Ota.i.x t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** uOt E'b& >V!!# Ota.i.x u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **vOt E'b& >V!!# Ota.i.x v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**wOt E'b& >V!!# Ota.i.x w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**xOt E'b& >V!!# Ota.i.x x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**yOt E'b& >V!!# Ota.i.x y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(zOt E'b& >V!!# Ota.i.x z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@{Ot E'b& >V!!# Ota.i.x { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&x C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy+@**0|Ot E'b& >V!!# Ota.i.x | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt+0** }Ot E'b& >V!!# Ota.i.x } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ~Ot E'b& >V!!# Ota.i.x ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **Ot E'b& >V!!# Ota.i.x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Ot E'b& >V!!# Ota.i.x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Ot E'b& >V!!# Ota.i.x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**00't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** 0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy+6@**00't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt+60** 0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** 0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(0't E'b& >V!!# 0'ta.i. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**C9} E'b& >V!!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :hl.exe 0 E'b& >V!# C9}V]ٓ  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .