ElfFile ElfChnkaape vdtDl=f?mMF5<&**r. E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25<6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** :Fe1 E'b& >V!!# :Fe1L2b02b0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  :Fe1 E'b& >V!!# :Fe1L2b02b0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy ** :Fe1 E'b& >V!!# :Fe1L2b02b0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** :Fe1 E'b& >V!!# :Fe1L2b02b0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** :Fe1 E'b& >V!!# :Fe1L2b02b0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** :Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** :Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** :Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(:Fe1 E'b& >V!!# :Fe1L2b02b0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  ͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**"͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**#͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** $͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **%͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**&͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**'͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0(͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**)͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h***͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**+͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**,͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** -͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **.͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**/͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 8/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**0͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 80 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**1͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 81 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(2͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 82 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@3͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 83 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**04͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 84 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** 5͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 85 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** 6͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 86 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **7͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 87 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**8͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 88 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(9͙Kg1 E'b& >V!!# ͙Kg1L2b0W2b0 89 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** :z]h1 E'b& >V!!# z]h1L2b0p2b0 P: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **;z]h1 E'b& >V!!# z]h1L2b0p2b0 P; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**<z]h1 E'b& >V!!# z]h1L2b0p2b0 P< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**=z]h1 E'b& >V!!# z]h1L2b0p2b0 P= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** >z]h1 E'b& >V!!# z]h1L2b0p2b0 P> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **?z]h1 E'b& >V!!# z]h1L2b0p2b0 P? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**@z]h1 E'b& >V!!# z]h1L2b0p2b0 P@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**Az]h1 E'b& >V!!# z]h1L2b0p2b0 PA ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0Bz]h1 E'b& >V!!# z]h1L2b0p2b0 PB ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**Cz]h1 E'b& >V!!# z]h1L2b0p2b0 PC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**Dz]h1 E'b& >V!!# z]h1L2b0p2b0 PD ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**Ez]h1 E'b& >V!!# z]h1L2b0p2b0 PE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Fz]h1 E'b& >V!!# z]h1L2b0p2b0 PF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** Gz]h1 E'b& >V!!# z]h1L2b0p2b0 PG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **Hz]h1 E'b& >V!!# z]h1L2b0p2b0 PH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**Iz]h1 E'b& >V!!# z]h1L2b0p2b0 PI ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**Jz]h1 E'b& >V!!# z]h1L2b0p2b0 PJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**Kz]h1 E'b& >V!!# z]h1L2b0p2b0 PK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(Lz]h1 E'b& >V!!# z]h1L2b0p2b0 PL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@Mz]h1 E'b& >V!!# z]h1L2b0p2b0 PM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0Nz]h1 E'b& >V!!# z]h1L2b0p2b0 PN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Oz]h1 E'b& >V!!# z]h1L2b0p2b0 PO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** Pz]h1 E'b& >V!!# z]h1L2b0p2b0 PP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **Qz]h1 E'b& >V!!# z]h1L2b0p2b0 PQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Rz]h1 E'b& >V!!# z]h1L2b0p2b0 PR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Sz]h1 E'b& >V!!# z]h1L2b0p2b0 PS ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** TtT~s3 E'b& >V!!# tT~s35353 T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **UtT~s3 E'b& >V!!# tT~s35353 U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**VtT~s3 E'b& >V!!# tT~s35353 V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**WtT~s3 E'b& >V!!# tT~s35353 W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** XtT~s3 E'b& >V!!# tT~s35353 X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **YtT~s3 E'b& >V!!# tT~s35353 Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ZtT~s3 E'b& >V!!# tT~s35353 Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**[tT~s3 E'b& >V!!# tT~s35353 [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0\tT~s3 E'b& >V!!# tT~s35353 \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**]tT~s3 E'b& >V!!# tT~s35353 ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**^tT~s3 E'b& >V!!# tT~s35353 ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**_tT~s3 E'b& >V!!# tT~s35353 _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**`tT~s3 E'b& >V!!# tT~s35353 ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** atT~s3 E'b& >V!!# tT~s35353 a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow owerShell\v1 E'b& >VE'b!# tT~s35353 b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkbծbծ0'Dl=f?mMF"&**btT~s3 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# tT~s35353 b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ctT~s3 E'b& >V!!# tT~s35353 c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**dtT~s3 E'b& >V!!# tT~s35353 d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**etT~s3 E'b& >V!!# tT~s35353 e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ftT~s3 E'b& >V!!# tT~s35353 f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@gtT~s3 E'b& >V!!# tT~s35353 g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0htT~s3 E'b& >V!!# tT~s35353 h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** itT~s3 E'b& >V!!# tT~s35353 i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** jtT~s3 E'b& >V!!# tT~s35353 j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ktT~s3 E'b& >V!!# tT~s35353 k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ltT~s3 E'b& >V!!# tT~s35353 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(mtT~s3 E'b& >V!!# tT~s35353 m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@n ds3 E'b& >V!!#  ds35353l n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2"6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**o ds3 E'b& >V!!#  ds35353l o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **p ds3 E'b& >V!!#  ds35353l p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **q ds3 E'b& >V!!#  ds35353l q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** r ds3 E'b& >V!!#  ds35353l r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **s ds3 E'b& >V!!#  ds35353l s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**t ds3 E'b& >V!!#  ds35353l t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**u ds3 E'b& >V!!#  ds35353l u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0v ds3 E'b& >V!!#  ds35353l v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**w ds3 E'b& >V!!#  ds35353l w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**x ds3 E'b& >V!!#  ds35353l x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**y ds3 E'b& >V!!#  ds35353l y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**z ds3 E'b& >V!!#  ds35353l z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** { ds3 E'b& >V!!#  ds35353l { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **| ds3 E'b& >V!!#  ds35353l | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**} ds3 E'b& >V!!#  ds35353l } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**~ ds3 E'b& >V!!#  ds35353l ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&l C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&DC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** k2d5 E'b& >V!!# k2d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678970**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-UShC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**®f5 E'b& >V!!# f5LE|_5|_5h(® ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**îf5 E'b& >V!!# f5LE|_5|_5h(î ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0Įf5 E'b& >V!!# f5LE|_5|_5h(Į ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789Q0**Ůf5 E'b& >V!!# f5LE|_5|_5h(Ů ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**Ʈf5 E'b& >V!!# f5LE|_5|_5h(Ʈ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Ǯf5 E'b& >V!!# f5LE|_5|_5h(Ǯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Ȯf5 E'b& >V!!# f5LE|_5|_5h(Ȯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ɮf5 E'b& >V!!# f5LE|_5|_5h(ɮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ʮf5 E'b& >V!!# f5LE|_5|_5h(ʮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ˮf5 E'b& >V!!# f5LE|_5|_5h(ˮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**̮f5 E'b& >V!!# f5LE|_5|_5h(̮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ͮf5 E'b& >V!!# f5LE|_5|_5h(ͮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ήf5 E'b& >V!!# f5LE|_5|_5h(ή ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@Ϯf5 E'b& >V!!# f5LE|_5|_5h(Ϯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&hC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0Юf5 E'b& >V!!# f5LE|_5|_5h(Ю ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** Ѯf5 E'b& >V!!# f5LE|_5|_5h(Ѯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** Үf5 E'b& >V!!# f5LE|_5|_5h(Ү ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Ӯf5 E'b& >V!!# f5LE|_5|_5h(Ӯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Ԯf5 E'b& >V!!# f5LE|_5|_5h(Ԯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ծDf5 E'b& >V!!# Df5LE|_5|_5h(ծ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk֮֮=@,wteDl=f?mMF& **֮qi5 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# qi5LE|_5,|_5֮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿W0$DD EventDataA=loData= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe**(׮qi5 E'b& >V!!# qi5LE|_5,|_5׮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . .Ŀ[9TDA)l= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r(**خqi5 E'b& >V!!# qi5LE|_5,|_5خ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**ٮqi5 E'b& >V!!# qi5LE|_5,|_5ٮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,r** ڮqi5 E'b& >V!!# qi5LE|_5,|_5ڮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0?w **ۮqi5 E'b& >V!!# qi5LE|_5,|_5ۮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0I**ܮqi5 E'b& >V!!# qi5LE|_5,|_5ܮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**ݮqi5 E'b& >V!!# qi5LE|_5,|_5ݮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $c**0ޮqi5 E'b& >V!!# qi5LE|_5,|_5ޮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ft-W0**߮qi5 E'b& >V!!# qi5LE|_5,|_5߮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-W**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2W**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .c**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,W** qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(qi5 E'b& >V!!# qi5LE|_5,|_5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy( **| ds3 E'b& >V!!#  ds35353l | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**} ds3 E'b& >V!!#  ds35353l } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**~ ds3 E'b& >V!!#  ds35353l ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&l C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( ds3 E'b& >V!!#  ds35353l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tl C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&DC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(O=s3 E'b& >V!!# O=s35353D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** k2d5 E'b& >V!!# k2d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**w$3d5 E'b& >V!!# w$3d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678970**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(,4d5 E'b& >V!!# ,4d5LE|_5~|_5T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-UShC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **f5 E'b& >V!!# f5LE|_5|_5h( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**®f5 E'b& >V!!# f5LE|_5|_5h(® ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**îf5 E'b& >V!!# f5LE|_5|_5h(î ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0Įf5 E'b& >V!!# f5LE|_5|_5h(Į ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789Q0**Ůf5 E'b& >V!!# f5LE|_5|_5h(Ů ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**Ʈf5 E'b& >V!!# f5LE|_5|_5h(Ʈ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Ǯf5 E'b& >V!!# f5LE|_5|_5h(Ǯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Ȯf5 E'b& >V!!# f5LE|_5|_5h(Ȯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ɮf5 E'b& >V!!# f5LE|_5|_5h(ɮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ʮf5 E'b& >V!!# f5LE|_5|_5h(ʮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ˮf5 E'b& >V!!# f5LE|_5|_5h(ˮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**̮f5 E'b& >V!!# f5LE|_5|_5h(̮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ͮf5 E'b& >V!!# f5LE|_5|_5h(ͮ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ήf5 E'b& >V!!# f5LE|_5|_5h(ή ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@Ϯf5 E'b& >V!!# f5LE|_5|_5h(Ϯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&hC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0Юf5 E'b& >V!!# f5LE|_5|_5h(Ю ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** Ѯf5 E'b& >V!!# f5LE|_5|_5h(Ѯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** Үf5 E'b& >V!!# f5LE|_5|_5h(Ү ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **Ӯf5 E'b& >V!!# f5LE|_5|_5h(Ӯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Ԯf5 E'b& >V!!# f5LE|_5|_5h(Ԯ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ծDf5 E'b& >V!!# Df5LE|_5|_5h(ծ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk } }p@P\iDl=f?mMF5<&** DAj E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# DAj>Z7,7,X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** DAj E'b& >V!!# DAj>Z7,7,X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  DAj E'b& >V!!# DAj>Z7,7,X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy ** DAj E'b& >V!!# DAj>Z7,7,X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe : **(DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **DAj E'b& >V!!# DAj>Z7,7,X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o** DAj E'b& >V!!# DAj>Z7,7,X  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(!DAj E'b& >V!!# DAj>Z7,7,X! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@"Dj E'b& >V!!# Dj>Z7,7,X " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25<6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**#Dj E'b& >V!!# Dj>Z7,7,X # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**$Dj E'b& >V!!# Dj>Z7,7,X $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**%fDj E'b& >V!!# fDj>Z7,7,X % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** &fDj E'b& >V!!# fDj>Z7,7,X & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **'fDj E'b& >V!!# fDj>Z7,7,X ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**(fDj E'b& >V!!# fDj>Z7,7,X ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**)fDj E'b& >V!!# fDj>Z7,7,X ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0*fDj E'b& >V!!# fDj>Z7,7,X * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**+fDj E'b& >V!!# fDj>Z7,7,X + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**,fDj E'b& >V!!# fDj>Z7,7,X , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**-fDj E'b& >V!!# fDj>Z7,7,X - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**.fDj E'b& >V!!# fDj>Z7,7,X . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** /fDj E'b& >V!!# fDj>Z7,7,X / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **0fDj E'b& >V!!# fDj>Z7,7,X 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**1fDj E'b& >V!!# fDj>Z7,7,X 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**2fDj E'b& >V!!# fDj>Z7,7,X 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**3fDj E'b& >V!!# fDj>Z7,7,X 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(4fDj E'b& >V!!# fDj>Z7,7,X 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@5fDj E'b& >V!!# fDj>Z7,7,X 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**06fDj E'b& >V!!# fDj>Z7,7,X 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** 7fDj E'b& >V!!# fDj>Z7,7,X 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** 8fDj E'b& >V!!# fDj>Z7,7,X 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **9fDj E'b& >V!!# fDj>Z7,7,X 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**:fDj E'b& >V!!# fDj>Z7,7,X : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(;fDj E'b& >V!!# fDj>Z7,7,X ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** <6 E'b& >V!!# 6񿌾< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **=6 E'b& >V!!# 6񿌾= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**>6 E'b& >V!!# 6񿌾> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**?6 E'b& >V!!# 6񿌾? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** @6 E'b& >V!!# 6񿌾@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **A6 E'b& >V!!# 6񿌾A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**B6 E'b& >V!!# 6񿌾B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**C6 E'b& >V!!# 6񿌾C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0D6 E'b& >V!!# 6񿌾D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**E6 E'b& >V!!# 6񿌾E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**F6 E'b& >V!!# 6񿌾F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**G6 E'b& >V!!# 6񿌾G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**H6 E'b& >V!!# 6񿌾H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** I6 E'b& >V!!# 6񿌾I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **J6 E'b& >V!!# 6񿌾J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**K6 E'b& >V!!# 6񿌾K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**L6 E'b& >V!!# 6񿌾L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**M6 E'b& >V!!# 6񿌾M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(N6 E'b& >V!!# 6񿌾N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@O6 E'b& >V!!# 6񿌾O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0P6 E'b& >V!!# 6񿌾P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Q6 E'b& >V!!# 6񿌾Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** R6 E'b& >V!!# 6񿌾R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **S6 E'b& >V!!# 6񿌾S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**T6 E'b& >V!!# 6񿌾T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(U6 E'b& >V!!# 6񿌾U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** VF]9 E'b& >V!!# F]9񿌾B$ V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **WF]9 E'b& >V!!# F]9񿌾B$ W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**XF]9 E'b& >V!!# F]9񿌾B$ X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**YF]9 E'b& >V!!# F]9񿌾B$ Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ZF]9 E'b& >V!!# F]9񿌾B$ Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **[F]9 E'b& >V!!# F]9񿌾B$ [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**\F]9 E'b& >V!!# F]9񿌾B$ \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**]F]9 E'b& >V!!# F]9񿌾B$ ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0^F]9 E'b& >V!!# F]9񿌾B$ ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**_F]9 E'b& >V!!# F]9񿌾B$ _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**`F]9 E'b& >V!!# F]9񿌾B$ ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**aF]9 E'b& >V!!# F]9񿌾B$ a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**bF]9 E'b& >V!!# F]9񿌾B$ b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** cF]9 E'b& >V!!# F]9񿌾B$ c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **dF]9 E'b& >V!!# F]9񿌾B$ d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**eF]9 E'b& >V!!# F]9񿌾B$ e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**fF]9 E'b& >V!!# F]9񿌾B$ f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**gF]9 E'b& >V!!# F]9񿌾B$ g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(hF]9 E'b& >V!!# F]9񿌾B$ h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@iF]9 E'b& >V!!# F]9񿌾B$ i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0jF]9 E'b& >V!!# F]9񿌾B$ j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** kF]9 E'b& >V!!# F]9񿌾B$ k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** lF]9 E'b& >V!!# F]9񿌾B$ l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **mF]9 E'b& >V!!# F]9񿌾B$ m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**nF]9 E'b& >V!!# F]9񿌾B$ n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(oF]9 E'b& >V!!# F]9񿌾B$ o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t$C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** pe?: E'b& >V!!# e?:񿌾[ @ p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ25< ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **qe?: E'b& >V!!# e?:񿌾[ @ q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**re?: E'b& >V!!# e?:񿌾[ @ r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**se?: E'b& >V!!# e?:񿌾[ @ s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** te?: E'b& >V!!# e?:񿌾[ @ t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **ue?: E'b& >V!!# e?:񿌾[ @ u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ve?: E'b& >V!!# e?:񿌾[ @ v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**we?: E'b& >V!!# e?:񿌾[ @ w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0xe?: E'b& >V!!# e?:񿌾[ @ x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**ye?: E'b& >V!!# e?:񿌾[ @ y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**ze?: E'b& >V!!# e?:񿌾[ @ z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**{e?: E'b& >V!!# e?:񿌾[ @ { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**|e?: E'b& >V!!# e?:񿌾[ @ | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** }e?: E'b& >V!!# e?:񿌾[ @ } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow owerShell\v1 E'b& >VE'b!# e?:񿌾[ @ ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnk~~D]А8Dl=f?mMF"&**~e?: E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# e?:񿌾[ @ ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(e?: E'b& >V!!# e?:񿌾[ @  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2"6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&x C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(W  E'b& >V!!# W Z    x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678990**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&P C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(MW  E'b& >V!!# MW Z  w  P  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** W  E'b& >V!!# W Z    L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **W  E'b& >V!!# W Z    L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**W  E'b& >V!!# W Z    L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**W  E'b& >V!!# W Z    L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ¨W  E'b& >V!!# W Z    L¨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **èW  E'b& >V!!# W Z    Lè ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ĨW  E'b& >V!!# W Z    LĨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ŨW  E'b& >V!!# W Z    LŨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0ƨW  E'b& >V!!# W Z    Lƨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789S0**ǨW  E'b& >V!!# W Z    LǨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**ȨW  E'b& >V!!# W Z    LȨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ɨW  E'b& >V!!# W Z    Lɨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ʨW  E'b& >V!!# W Z    Lʨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ˨W  E'b& >V!!# W Z    L˨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **̨W  E'b& >V!!# W Z    L̨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ͨW  E'b& >V!!# W Z    Lͨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ΨW  E'b& >V!!# W Z    LΨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ϨW  E'b& >V!!# W Z    LϨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ШW  E'b& >V!!# W Z    LШ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ѨW  E'b& >V!!# W Z    LѨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ҨW  E'b& >V!!# W Z    LҨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ӨW  E'b& >V!!# W Z    LӨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ԨW  E'b& >V!!# W Z    LԨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ըW  E'b& >V!!# W Z    Lը ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**֨W  E'b& >V!!# W Z    L֨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(רW  E'b& >V!!# W Z    Lר ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ب ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ب ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2" ten-US8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **٨ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8٨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ڨ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ڨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ۨ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ۨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ܨ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ܨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ݨ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ݨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ި ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ި ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ߨ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8ߨ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0 ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789m0** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**( ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@ ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM **  ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( ѻ  E'b& >V!!#  ѻ ׋u 2؋u 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t8C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkeepeaN?Dl=f?mMF& **Vӻ  E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿W0$DD EventDataA=loData= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe**(Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . .Ŀ[9TDA)l= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2r(**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,r** Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0?w **Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0I**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $c**0Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ft-W0**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-W**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2W**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .c**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,W** Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe ** Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( Vӻ  E'b& >V!!# Vӻ ׋u p؋u  0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  Ի  E'b& >V!!# Ի ׋u ؋u   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** Ի  E'b& >V!!# Ի ׋u ؋u   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@Ի  E'b& >V!!# Ի ׋u ؋u  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0 Ի  E'b& >V!!# Ի ׋u ؋u   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** !Ի  E'b& >V!!# Ի ׋u ؋u ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** "Ի  E'b& >V!!# Ի ׋u ؋u " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **#Ի  E'b& >V!!# Ի ׋u ؋u # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**$Ի  E'b& >V!!# Ի ׋u ؋u $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(%Ի  E'b& >V!!# Ի ׋u ؋u % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** &!x E'b& >V!!# !x_<><> & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **'!x E'b& >V!!# !x_<><> ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**(!x E'b& >V!!# !x_<><> ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**)!x E'b& >V!!# !x_<><> ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** *!x E'b& >V!!# !x_<><> * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **+!x E'b& >V!!# !x_<><> + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**,!x E'b& >V!!# !x_<><> , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**-!x E'b& >V!!# !x_<><> - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0.!x E'b& >V!!# !x_<><> . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**/!x E'b& >V!!# !x_<><> / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**0!x E'b& >V!!# !x_<><> 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**1!x E'b& >V!!# !x_<><> 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**2!x E'b& >V!!# !x_<><> 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** 3!x E'b& >V!!# !x_<><> 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **4!x E'b& >V!!# !x_<><> 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**5!x E'b& >V!!# !x_<><> 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**6!x E'b& >V!!# !x_<><> 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**7!x E'b& >V!!# !x_<><> 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(8!x E'b& >V!!# !x_<><> 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@9!x E'b& >V!!# !x_<><> 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0:!x E'b& >V!!# !x_<><> : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** ;!x E'b& >V!!# !x_<><> ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** <!x E'b& >V!!# !x_<><> < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **=!x E'b& >V!!# !x_<><> = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**>!x E'b& >V!!# !x_<><> > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(?!x E'b& >V!!# !x_<><> ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** @Gx E'b& >V!!# Gx_<><>h@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-UShC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **AGx E'b& >V!!# Gx_<><>hA ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**BGx E'b& >V!!# Gx_<><>hB ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**CGx E'b& >V!!# Gx_<><>hC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** DGx E'b& >V!!# Gx_<><>hD ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **EGx E'b& >V!!# Gx_<><>hE ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**FGx E'b& >V!!# Gx_<><>hF ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**GGx E'b& >V!!# Gx_<><>hG ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0HGx E'b& >V!!# Gx_<><>hH ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**IGx E'b& >V!!# Gx_<><>hI ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**JGx E'b& >V!!# Gx_<><>hJ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**KGx E'b& >V!!# Gx_<><>hK ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**LGx E'b& >V!!# Gx_<><>hL ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** MGx E'b& >V!!# Gx_<><>hM ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **NGx E'b& >V!!# Gx_<><>hN ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**OGx E'b& >V!!# Gx_<><>hO ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**PGx E'b& >V!!# Gx_<><>hP ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**QGx E'b& >V!!# Gx_<><>hQ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(RGx E'b& >V!!# Gx_<><>hR ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@SGx E'b& >V!!# Gx_<><>hS ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t&hC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0TGx E'b& >V!!# Gx_<><>hT ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** UGx E'b& >V!!# Gx_<><>hU ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** VGx E'b& >V!!# Gx_<><>hV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **WGx E'b& >V!!# Gx_<><>hW ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**XGx E'b& >V!!# Gx_<><>hX ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(YGx E'b& >V!!# Gx_<><>hY ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . thC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ZXx E'b& >V!!# Xx_<><> x Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **[Xx E'b& >V!!# Xx_<><> x [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**\Xx E'b& >V!!# Xx_<><> x \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**]Xx E'b& >V!!# Xx_<><> x ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ^Xx E'b& >V!!# Xx_<><> x ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **_Xx E'b& >V!!# Xx_<><> x _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**`Xx E'b& >V!!# Xx_<><> x ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**aXx E'b& >V!!# Xx_<><> x a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0bXx E'b& >V!!# Xx_<><> x b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**cXx E'b& >V!!# Xx_<><> x c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**dXx E'b& >V!!# Xx_<><> x d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**eXx E'b& >V!!# Xx_<><> x e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .hl\v1.0\power E'b& >VE'b!# Xx_<><> x f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkf٩f٩ zDl=f?mMF%'&**fXx E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# Xx_<><> x f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l.** gXx E'b& >V!!# Xx_<><> x g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0l **hXx E'b& >V!!# Xx_<><> x h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1i**iXx E'b& >V!!# Xx_<><> x i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+i**jXx E'b& >V!!# Xx_<><> x j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /i**kXx E'b& >V!!# Xx_<><> x k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :r**(lXx E'b& >V!!# Xx_<><> x l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyal(**@mXx E'b& >V!!# Xx_<><> x m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyt-Wi@**0nXx E'b& >V!!# Xx_<><> x n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tttern0** oXx E'b& >V!!# Xx_<><> x o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMndow ** pXx E'b& >V!!# Xx_<><> x p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMs-In **qXx E'b& >V!!# Xx_<><> x q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6n**rXx E'b& >V!!# Xx_<><> x r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0n**(sXx E'b& >V!!# Xx_<><> x s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyo(**@tX E'b& >V!!# XM4M4 t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%'6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**uX E'b& >V!!# XM4M4 u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**vX E'b& >V!!# XM4M4 v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**wX E'b& >V!!# XM4M4 w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** xX E'b& >V!!# XM4M4 x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **yX E'b& >V!!# XM4M4 y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**zX E'b& >V!!# XM4M4 z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**{X E'b& >V!!# XM4M4 { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0|X E'b& >V!!# XM4M4 | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789V0**}X E'b& >V!!# XM4M4 } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**~X E'b& >V!!# XM4M4 ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(X E'b& >V!!# XM4M4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-US( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**f E'b& >V!!# fM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(]rh E'b& >V!!# ]rhM4M4(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t( C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** !g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789!0**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** !g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** !g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(!g E'b& >V!!# !gM4M4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ©C1; E'b& >V!!# C1;up## © ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2%' ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **éC1; E'b& >V!!# C1;up## é ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ĩw; E'b& >V!!# w;up## ĩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ũw; E'b& >V!!# w;up## ũ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Ʃw; E'b& >V!!# w;up## Ʃ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ǩw; E'b& >V!!# w;up## ǩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ȩw; E'b& >V!!# w;up## ȩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ɩw; E'b& >V!!# w;up## ɩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0ʩw; E'b& >V!!# w;up## ʩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789G0**˩w; E'b& >V!!# w;up## ˩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**̩w; E'b& >V!!# w;up## ̩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ͩw; E'b& >V!!# w;up## ͩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Ωw; E'b& >V!!# w;up## Ω ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ϩw; E'b& >V!!# w;up## ϩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **Щw; E'b& >V!!# w;up## Щ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ѩw; E'b& >V!!# w;up## ѩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ҩw; E'b& >V!!# w;up## ҩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y**өw; E'b& >V!!# w;up## ө ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ԩw; E'b& >V!!# w;up## ԩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@թw; E'b& >V!!# w;up## թ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0֩w; E'b& >V!!# w;up## ֩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** שw; E'b& >V!!# w;up## ש ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ةw; E'b& >V!!# w;up## ة ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **٩w; E'b& >V!!# w;up## ٩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6  E'b& >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkکMکM6(b#Dl=f?mMF &**کw; E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# w;up## ک ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0l.**(۩w; E'b& >V!!# w;up## ۩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@ܩ; E'b& >V!!# ;up#Q#l ܩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**ݩ; E'b& >V!!# ;up#Q#l ݩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**ީ; E'b& >V!!# ;up#Q#l ީ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**ߩ; E'b& >V!!# ;up#Q#l ߩ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** ; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** ; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(; E'b& >V!!# ;up#Q#l  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0 }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670**  }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q **  }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 ** }+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(}+J; E'b& >V!!# }+J;up#j#  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** _| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** _| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** _| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**_| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** _| E'b& >V!!# _|(2QA2QH,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**!_| E'b& >V!!# _|(2QA2QH, ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**("_| E'b& >V!!# _|(2QA2QH, " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@#_| E'b& >V!!# _|(2QA2QH, # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&HC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0$_| E'b& >V!!# _|(2QA2QH, $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** %_| E'b& >V!!# _|(2QA2QH, % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** &_| E'b& >V!!# _|(2QA2QH, & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **'_| E'b& >V!!# _|(2QA2QH, ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**(_| E'b& >V!!# _|(2QA2QH, ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**()_| E'b& >V!!# _|(2QA2QH, ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tHC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** *  E'b& >V!!#  (2QA2Q* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **+  E'b& >V!!#  (2QA2Q+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**,  E'b& >V!!#  (2QA2Q, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**-  E'b& >V!!#  (2QA2Q- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** .  E'b& >V!!#  (2QA2Q. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **/  E'b& >V!!#  (2QA2Q/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**0  E'b& >V!!#  (2QA2Q0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**1  E'b& >V!!#  (2QA2Q1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**02  E'b& >V!!#  (2QA2Q2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**3  E'b& >V!!#  (2QA2Q3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**4  E'b& >V!!#  (2QA2Q4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**5  E'b& >V!!#  (2QA2Q5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**6  E'b& >V!!#  (2QA2Q6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** 7  E'b& >V!!#  (2QA2Q7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **8  E'b& >V!!#  (2QA2Q8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**9  E'b& >V!!#  (2QA2Q9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**:  E'b& >V!!#  (2QA2Q: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**;  E'b& >V!!#  (2QA2Q; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(<  E'b& >V!!#  (2QA2Q< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@=  E'b& >V!!#  (2QA2Q= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0>  E'b& >V!!#  (2QA2Q> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ?  E'b& >V!!#  (2QA2Q? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** @  E'b& >V!!#  (2QA2Q@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **A  E'b& >V!!#  (2QA2QA ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**B  E'b& >V!!#  (2QA2QB ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(C  E'b& >V!!#  (2QA2QC ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** DK8 E'b& >V!!# K8(2Q B2Q D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **EK8 E'b& >V!!# K8(2Q B2Q E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**FK8 E'b& >V!!# K8(2Q B2Q F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**GK8 E'b& >V!!# K8(2Q B2Q G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** HK8 E'b& >V!!# K8(2Q B2Q H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **IK8 E'b& >V!!# K8(2Q B2Q I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**JK8 E'b& >V!!# K8(2Q B2Q J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**KK8 E'b& >V!!# K8(2Q B2Q K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0LK8 E'b& >V!!# K8(2Q B2Q L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**MK8 E'b& >V!!# K8(2Q B2Q M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0owershell.ex E'b& >V >V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkNNok%y1{Dl=f?mMFU+&**NK8 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# K8(2Q B2Q N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2l.**OK8 E'b& >V!!# K8(2Q B2Q O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**PK8 E'b& >V!!# K8(2Q B2Q P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** QK8 E'b& >V!!# K8(2Q B2Q Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ndo **RK8 E'b& >V!!# K8(2Q B2Q R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1o**SK8 E'b& >V!!# K8(2Q B2Q S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+o**TK8 E'b& >V!!# K8(2Q B2Q T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /o**UK8 E'b& >V!!# K8(2Q B2Q U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :W**(VK8 E'b& >V!!# K8(2Q B2Q V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy-I(**@WK8 E'b& >V!!# K8(2Q B2Q W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy.?w@**0XK8 E'b& >V!!# K8(2Q B2Q X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttt-Wi0** YK8 E'b& >V!!# K8(2Q B2Q Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMMicr ** ZK8 E'b& >V!!# K8(2Q B2Q Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMosof **[K8 E'b& >V!!# K8(2Q B2Q [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6f**\K8 E'b& >V!!# K8(2Q B2Q \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0f**(]K8 E'b& >V!!# K8(2Q B2Q ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyw(**@^ E'b& >V!!# #۶X^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**_ E'b& >V!!# #۶X_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**` E'b& >V!!# #۶X` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**au E'b& >V!!# u#۶Xa ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** bu E'b& >V!!# u#۶Xb ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **cu E'b& >V!!# u#۶Xc ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**du E'b& >V!!# u#۶Xd ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**eu E'b& >V!!# u#۶Xe ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0fu E'b& >V!!# u#۶Xf ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**gu E'b& >V!!# u#۶Xg ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**hu E'b& >V!!# u#۶Xh ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**iu E'b& >V!!# u#۶Xi ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**ju E'b& >V!!# u#۶Xj ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ku E'b& >V!!# u#۶Xk ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **lu E'b& >V!!# u#۶Xl ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**mu E'b& >V!!# u#۶Xm ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**nu E'b& >V!!# u#۶Xn ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ou E'b& >V!!# u#۶Xo ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(pu E'b& >V!!# u#۶Xp ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@qu E'b& >V!!# u#۶Xq ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&XC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ru E'b& >V!!# u#۶Xr ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** su E'b& >V!!# u#۶Xs ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** tu E'b& >V!!# u#۶Xt ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **uu E'b& >V!!# u#۶Xu ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**vu E'b& >V!!# u#۶Xv ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(wu E'b& >V!!# u#۶Xw ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tXC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** xj E'b& >V!!# j#x x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **yj E'b& >V!!# j#x y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**zj E'b& >V!!# j#x z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**{j E'b& >V!!# j#x { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** |j E'b& >V!!# j#x | ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **}j E'b& >V!!# j#x } ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**~j E'b& >V!!# j#x ~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&x C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& ** j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(j E'b& >V!!# j#x  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tx C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**  Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-USd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 ** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**  Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe ** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**( Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&d C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0 Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0**  Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b& **  Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM ** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6** Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**( Ƨ E'b& >V!!#  Ƨ#2d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .td C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2U+ ten-US0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678920**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .M**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0xe **tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :.**(tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** tNN E'b& >V!!# tNNM@1@10 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AME'b&  E'b& >VV ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational . ElfChnkª5ª5pRZwDl=f?mMF&**ªtNN E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# tNNM@1@10ª ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM.**êtNN E'b& >V!!# tNNM@1@10ê ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**ĪtNN E'b& >V!!# tNNM@1@10Ī ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ŪtNN E'b& >V!!# tNNM@1@10Ū ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@ƪVPN E'b& >V!!# VPNM@1͆@1 ƪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exet-Wi@**ǪVPN E'b& >V!!# VPNM@1͆@1 Ǫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**ȪVPN E'b& >V!!# VPNM@1͆@1 Ȫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .i**ɪVPN E'b& >V!!# VPNM@1͆@1 ɪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,i** ʪVPN E'b& >V!!# VPNM@1͆@1 ʪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0sof **˪VPN E'b& >V!!# VPNM@1͆@1 ˪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0i**̪VPN E'b& >V!!# VPNM@1͆@1 ̪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0o**ͪVPN E'b& >V!!# VPNM@1͆@1 ͪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $W**0ΪVPN E'b& >V!!# VPNM@1͆@1 Ϊ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ws-I0**ϪVPN E'b& >V!!# VPNM@1͆@1 Ϫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-I**ЪVPN E'b& >V!!# VPNM@1͆@1 Ъ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2I**ѪVPN E'b& >V!!# VPNM@1͆@1 Ѫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .W**ҪVPN E'b& >V!!# VPNM@1͆@1 Ҫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** ӪVPN E'b& >V!!# VPNM@1͆@1 Ӫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **ԪVPN E'b& >V!!# VPNM@1͆@1 Ԫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**ժVPN E'b& >V!!# VPNM@1͆@1 ժ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**֪VPN E'b& >V!!# VPNM@1͆@1 ֪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**תVPN E'b& >V!!# VPNM@1͆@1 ת ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(تVPN E'b& >V!!# VPNM@1͆@1 ت ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@٪VPN E'b& >V!!# VPNM@1͆@1 ٪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0ڪVPN E'b& >V!!# VPNM@1͆@1 ڪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** ۪VPN E'b& >V!!# VPNM@1͆@1 ۪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** ܪVPN E'b& >V!!# VPNM@1͆@1 ܪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **ݪVPN E'b& >V!!# VPNM@1͆@1 ݪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**ުVPN E'b& >V!!# VPNM@1͆@1 ު ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(ߪVPN E'b& >V!!# VPNM@1͆@1 ߪ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(sQN E'b& >V!!# sQNM@1@1X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-UST C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**( `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@ `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&T C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** `w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(`w E'b& >V!!# `wc'cT   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** $Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** $Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\**0$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789\pow0**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-0**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 20**$Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .0** $Yw E'b& >V!!# $YwcA'c0  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** !$Yw E'b& >V!!# $YwcA'c0 ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0rSh **"$Yw E'b& >V!!# $YwcA'c0 " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1h**#$Yw E'b& >V!!# $YwcA'c0 # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+h**$$Yw E'b& >V!!# $YwcA'c0 $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /h**%$Yw E'b& >V!!# $YwcA'c0 % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :w**(&$Yw E'b& >V!!# $YwcA'c0 & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyl\(**@'$Yw E'b& >V!!# $YwcA'c0 ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyexe@**0($Yw E'b& >V!!# $YwcA'c0 ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt45670** )$Yw E'b& >V!!# $YwcA'c0 ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM Q ** *$Yw E'b& >V!!# $YwcA'c0 * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM2 **+$Yw E'b& >V!!# $YwcA'c0 + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6M**,$Yw E'b& >V!!# $YwcA'c0 , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0h**(-$Yw E'b& >V!!# $YwcA'c0 - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ./w E'b& >V!!# /wcZ'c| . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **//w E'b& >V!!# /wcZ'c| / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**0/w E'b& >V!!# /wcZ'c| 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**1/w E'b& >V!!# /wcZ'c| 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 2/w E'b& >V!!# /wcZ'c| 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **3/w E'b& >V!!# /wcZ'c| 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0M**4/w E'b& >V!!# /wcZ'c| 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0h**5/w E'b& >V!!# /wcZ'c| 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $\.0\powershel E'b& >V!# /wcZ'c| 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnk66xCp [Dl=f?mMF/&**6/w E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# /wcZ'c| 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789**7/w E'b& >V!!# /wcZ'c| 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**8/w E'b& >V!!# /wcZ'c| 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**9/w E'b& >V!!# /wcZ'c| 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**:/w E'b& >V!!# /wcZ'c| : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,o** ;/w E'b& >V!!# /wcZ'c| ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ter **</w E'b& >V!!# /wcZ'c| < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1r**=/w E'b& >V!!# /wcZ'c| = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+r**>/w E'b& >V!!# /wcZ'c| > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /r**?/w E'b& >V!!# /wcZ'c| ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :I**(@/w E'b& >V!!# /wcZ'c| @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyti(**@A/w E'b& >V!!# /wcZ'c| A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyosof@**0B/w E'b& >V!!# /wcZ'c| B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tts-In0** C/w E'b& >V!!# /wcZ'c| C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMt-Wi ** D/w E'b& >V!!# /wcZ'c| D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMndow **E/w E'b& >V!!# /wcZ'c| E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6w**F/w E'b& >V!!# /wcZ'c| F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0w**(G/w E'b& >V!!# /wcZ'c| G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t|C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyn(**@Hku{ E'b& >V!!# ku{vnU0U0 H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/6Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**Iku{ E'b& >V!!# ku{vnU0U0 I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Jku{ E'b& >V!!# ku{vnU0U0 J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Kku{ E'b& >V!!# ku{vnU0U0 K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Lku{ E'b& >V!!# ku{vnU0U0 L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Mku{ E'b& >V!!# ku{vnU0U0 M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Nku{ E'b& >V!!# ku{vnU0U0 N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Oku{ E'b& >V!!# ku{vnU0U0 O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0Pku{ E'b& >V!!# ku{vnU0U0 P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ݪ0**Qku{ E'b& >V!!# ku{vnU0U0 Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**Rku{ E'b& >V!!# ku{vnU0U0 R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Sku{ E'b& >V!!# ku{vnU0U0 S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Tku{ E'b& >V!!# ku{vnU0U0 T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** Uku{ E'b& >V!!# ku{vnU0U0 U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Vku{ E'b& >V!!# ku{vnU0U0 V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Wku{ E'b& >V!!# ku{vnU0U0 W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Xku{ E'b& >V!!# ku{vnU0U0 X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Yku{ E'b& >V!!# ku{vnU0U0 Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Zku{ E'b& >V!!# ku{vnU0U0 Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@[ku{ E'b& >V!!# ku{vnU0U0 [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0\ku{ E'b& >V!!# ku{vnU0U0 \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ]ku{ E'b& >V!!# ku{vnU0U0 ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ^ku{ E'b& >V!!# ku{vnU0U0 ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **_ku{ E'b& >V!!# ku{vnU0U0 _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**`ku{ E'b& >V!!# ku{vnU0U0 ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(aku{ E'b& >V!!# ku{vnU0U0 a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** b*} E'b& >V!!# *}vnU0U0 b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **c*} E'b& >V!!# *}vnU0U0 c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**d*} E'b& >V!!# *}vnU0U0 d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**e*} E'b& >V!!# *}vnU0U0 e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** f*} E'b& >V!!# *}vnU0U0 f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **g*} E'b& >V!!# *}vnU0U0 g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**h*} E'b& >V!!# *}vnU0U0 h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**i*} E'b& >V!!# *}vnU0U0 i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0j*} E'b& >V!!# *}vnU0U0 j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**k*} E'b& >V!!# *}vnU0U0 k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**l*} E'b& >V!!# *}vnU0U0 l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**m*} E'b& >V!!# *}vnU0U0 m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**n*} E'b& >V!!# *}vnU0U0 n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** o*} E'b& >V!!# *}vnU0U0 o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **p*} E'b& >V!!# *}vnU0U0 p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**q*} E'b& >V!!# *}vnU0U0 q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**r*} E'b& >V!!# *}vnU0U0 r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**s*} E'b& >V!!# *}vnU0U0 s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(t*} E'b& >V!!# *}vnU0U0 t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@u*} E'b& >V!!# *}vnU0U0 u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0v*} E'b& >V!!# *}vnU0U0 v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** w*} E'b& >V!!# *}vnU0U0 w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** x*} E'b& >V!!# *}vnU0U0 x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **y*} E'b& >V!!# *}vnU0U0 y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**z*} E'b& >V!!# *}vnU0U0 z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**({*} E'b& >V!!# *}vnU0U0 { ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** |=~ E'b& >V!!# =~vnU0U0l| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **}=~ E'b& >V!!# =~vnU0U0l} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**~=~ E'b& >V!!# =~vnU0U0l~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** =~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 01234567890**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** =~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** =~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** =~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(=~ E'b& >V!!# =~vnU0U0l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2/ ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789+0**k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**k.Z?! E'b& >V!!# k.Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** [Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**([Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@ E'b& >V 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkցxߩDl=f?mMF&**[Z?! E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt** [Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** [Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM9 **[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**[Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**([Z?! E'b& >V!!# [Z?!:ؒ!q!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exes-In@**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2n**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .n**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,n** 2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0r**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $I**02_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789nati0**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .I**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,l** 2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**2_?! E'b& >V!!# 2_?!:ؒ!! |  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(«2_?! E'b& >V!!# 2_?!:ؒ!! | « ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ë2_?! E'b& >V!!# 2_?!:ؒ!! | ë ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0ī2_?! E'b& >V!!# 2_?!:ؒ!! | ī ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttݪ0** ū2_?! E'b& >V!!# 2_?!:ؒ!! | ū ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** ƫ2_?! E'b& >V!!# 2_?!:ؒ!! | ƫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMS **ǫ2_?! E'b& >V!!# 2_?!:ؒ!! | ǫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ȫ2_?! E'b& >V!!# 2_?!:ؒ!! | ȫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ɫ2_?! E'b& >V!!# 2_?!:ؒ!! | ɫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy{(** ʫP`?! E'b& >V!!# P`?!:ؒ!! ʫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **˫P`?! E'b& >V!!# P`?!:ؒ!! ˫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**̫P`?! E'b& >V!!# P`?!:ؒ!! ̫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ͫP`?! E'b& >V!!# P`?!:ؒ!! ͫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ΫP`?! E'b& >V!!# P`?!:ؒ!! Ϋ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ku{ **ϫP`?! E'b& >V!!# P`?!:ؒ!! ϫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**ЫP`?! E'b& >V!!# P`?!:ؒ!! Ы ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ѫP`?! E'b& >V!!# P`?!:ؒ!! ѫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0ҫP`?! E'b& >V!!# P`?!:ؒ!! ҫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**ӫP`?! E'b& >V!!# P`?!:ؒ!! ӫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**ԫP`?! E'b& >V!!# P`?!:ؒ!! ԫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**իP`?! E'b& >V!!# P`?!:ؒ!! ի ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**֫P`?! E'b& >V!!# P`?!:ؒ!! ֫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** ׫P`?! E'b& >V!!# P`?!:ؒ!! ׫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **ثP`?! E'b& >V!!# P`?!:ؒ!! ث ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**٫P`?! E'b& >V!!# P`?!:ؒ!! ٫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**ګP`?! E'b& >V!!# P`?!:ؒ!! ګ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**۫P`?! E'b& >V!!# P`?!:ؒ!! ۫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(ܫP`?! E'b& >V!!# P`?!:ؒ!! ܫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@ݫP`?! E'b& >V!!# P`?!:ؒ!! ݫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0ޫP`?! E'b& >V!!# P`?!:ؒ!! ޫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ߫P`?! E'b& >V!!# P`?!:ؒ!! ߫ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** P`?! E'b& >V!!# P`?!:ؒ!!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMm **P`?! E'b& >V!!# P`?!:ؒ!!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**P`?! E'b& >V!!# P`?!:ؒ!!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(P`?! E'b& >V!!# P`?!:ؒ!!  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy}(** " E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** " E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0*} **" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h** " E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 **" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** " E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** " E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(" E'b& >V!!# " ")"\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy~(** " E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** " E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0=~ **" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell.0**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** " E'b& >V!!# " "*"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h** " E'b& >V!!# " "*"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,h**  " E'b& >V!!# " "*"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;01.0 ** " E'b& >V!!# " "*"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 10** " E'b& >V!!# " "*"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+0**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /0**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :\**(" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy$@**0" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt+0** " E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM** ** " E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(" E'b& >V!!# " "*" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyZ(** !" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **!" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**!" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**!" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** !" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0[Z **!" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0y@ E'b& >V>V 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkp${Dl=f?mMF3&**!" E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0m:**!" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0 !" E'b& >V!!# !" "**"  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**!!" E'b& >V!!# !" "**" ! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**"!" E'b& >V!!# !" "**" " ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**#!" E'b& >V!!# !" "**" # ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**$!" E'b& >V!!# !" "**" $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** %!" E'b& >V!!# !" "**" % ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0t-W **&!" E'b& >V!!# !" "**" & ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1W**'!" E'b& >V!!# !" "**" ' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+W**(!" E'b& >V!!# !" "**" ( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /W**)!" E'b& >V!!# !" "**" ) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :o**(*!" E'b& >V!!# !" "**" * ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyydo(**@+!" E'b& >V!!# !" "**" + ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy+:Wc@**0,($" E'b& >V!!# ($" "**" , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttosof0** -($" E'b& >V!!# ($" "**" - ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM.?w ** .($" E'b& >V!!# ($" "**" . ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMMicr **/($" E'b& >V!!# ($" "**" / ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6r**0($" E'b& >V!!# ($" "**" 0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0r**(1($" E'b& >V!!# ($" "**" 1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyi(**@2ji$ E'b& >V!!# ji$f4Y?$5Y?$ 2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ236Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe@**3ji$ E'b& >V!!# ji$f4Y?$5Y?$ 3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**4ji$ E'b& >V!!# ji$f4Y?$5Y?$ 4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**5ji$ E'b& >V!!# ji$f4Y?$5Y?$ 5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** 6ji$ E'b& >V!!# ji$f4Y?$5Y?$ 6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **7ji$ E'b& >V!!# ji$f4Y?$5Y?$ 7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**8ji$ E'b& >V!!# ji$f4Y?$5Y?$ 8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **9ji$ E'b& >V!!# ji$f4Y?$5Y?$ 9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0:ji$ E'b& >V!!# ji$f4Y?$5Y?$ : ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**;ji$ E'b& >V!!# ji$f4Y?$5Y?$ ; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**<ji$ E'b& >V!!# ji$f4Y?$5Y?$ < ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**=ji$ E'b& >V!!# ji$f4Y?$5Y?$ = ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**>ji$ E'b& >V!!# ji$f4Y?$5Y?$ > ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** ?ji$ E'b& >V!!# ji$f4Y?$5Y?$ ? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **@ji$ E'b& >V!!# ji$f4Y?$5Y?$ @ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**Aji$ E'b& >V!!# ji$f4Y?$5Y?$ A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**Bji$ E'b& >V!!# ji$f4Y?$5Y?$ B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**Cji$ E'b& >V!!# ji$f4Y?$5Y?$ C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(Dji$ E'b& >V!!# ji$f4Y?$5Y?$ D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@Eji$ E'b& >V!!# ji$f4Y?$5Y?$ E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyP`@**0Fji$ E'b& >V!!# ji$f4Y?$5Y?$ F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttP`0** Gji$ E'b& >V!!# ji$f4Y?$5Y?$ G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM! ** Hji$ E'b& >V!!# ji$f4Y?$5Y?$ H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **Iji$ E'b& >V!!# ji$f4Y?$5Y?$ I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Jji$ E'b& >V!!# ji$f4Y?$5Y?$ J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Kji$ E'b& >V!!# ji$f4Y?$5Y?$ K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** L!li$ E'b& >V!!# !li$f4Y?$5Y?$L L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-USLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **M!li$ E'b& >V!!# !li$f4Y?$5Y?$L M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**N!li$ E'b& >V!!# !li$f4Y?$5Y?$L N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**O!li$ E'b& >V!!# !li$f4Y?$5Y?$L O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** P!li$ E'b& >V!!# !li$f4Y?$5Y?$L P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Q!li$ E'b& >V!!# !li$f4Y?$5Y?$L Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**R!li$ E'b& >V!!# !li$f4Y?$5Y?$L R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **S!li$ E'b& >V!!# !li$f4Y?$5Y?$L S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0T!li$ E'b& >V!!# !li$f4Y?$5Y?$L T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**U!li$ E'b& >V!!# !li$f4Y?$5Y?$L U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**V!li$ E'b& >V!!# !li$f4Y?$5Y?$L V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**W!li$ E'b& >V!!# !li$f4Y?$5Y?$L W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**X!li$ E'b& >V!!# !li$f4Y?$5Y?$L X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** Y!li$ E'b& >V!!# !li$f4Y?$5Y?$L Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **Z!li$ E'b& >V!!# !li$f4Y?$5Y?$L Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**[!li$ E'b& >V!!# !li$f4Y?$5Y?$L [ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**\!li$ E'b& >V!!# !li$f4Y?$5Y?$L \ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**]!li$ E'b& >V!!# !li$f4Y?$5Y?$L ] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(^!li$ E'b& >V!!# !li$f4Y?$5Y?$L ^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@_!li$ E'b& >V!!# !li$f4Y?$5Y?$L _ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&LC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0`!li$ E'b& >V!!# !li$f4Y?$5Y?$L ` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** a!li$ E'b& >V!!# !li$f4Y?$5Y?$L a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM" ** b!li$ E'b& >V!!# !li$f4Y?$5Y?$L b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **c!li$ E'b& >V!!# !li$f4Y?$5Y?$L c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**d!li$ E'b& >V!!# !li$f4Y?$5Y?$L d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(e!li$ E'b& >V!!# !li$f4Y?$5Y?$L e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tLC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** f‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ23 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **g‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**h‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**i‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** j‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **k‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**l‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0 **m‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0n‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789PM0**o‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**p‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**q‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**r‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,w** s‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0ll. **t‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1.**u‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+.**v‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /.**w‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :h**(x‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyye(**@y‰tmi$ E'b& >V!!# ‰tmi$f4Y?$5Y?$ ,y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0zvmi$ E'b& >V!!# vmi$f4Y?$5Y?$ ,z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** {vmi$ E'b& >V!!# vmi$f4Y?$5Y?$ ,{ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM" ** |vmi$ E'b& >V!!# vmi$f4Y?$5Y?$ ,| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PME'b& **}vmi$ E'b& >V!!# vmi$f4Y?$5Y?$ ,} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**~vmi$ E'b& >V!!# vmi$f4Y?$5Y?$ ,~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(vmi$ E'b& >V!!# vmi$f4Y?$5Y?$ , ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** =& E'b& >V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!# =&Vwؚ& Dl=f?mMF&**=& E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# =&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# @&Vwؚ&V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789j0**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-j**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2j**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** A& E'b& >V!!# A&Vwؚ&=wؚ&x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **¬A& E'b& >V!!# A&Vwؚ&=wؚ&x¬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ìA& E'b& >V!!# A&Vwؚ&=wؚ&xì ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ĬA& E'b& >V!!# A&Vwؚ&=wؚ&xĬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ŬA& E'b& >V!!# A&Vwؚ&=wؚ&xŬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ƬA& E'b& >V!!# A&Vwؚ&=wؚ&xƬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ǬA& E'b& >V!!# A&Vwؚ&=wؚ&xǬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ȬA& E'b& >V!!# A&Vwؚ&=wؚ&xȬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ɬA& E'b& >V!!# A&Vwؚ&=wؚ&xɬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ʬA& E'b& >V!!# A&Vwؚ&=wؚ&xʬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ˬA& E'b& >V!!# A&Vwؚ&=wؚ&xˬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**̬A& E'b& >V!!# A&Vwؚ&=wؚ&x̬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ͬA& E'b& >V!!# A&Vwؚ&=wؚ&xͬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** άG`l/) E'b& >V!!# G`l/)(( $ά ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ϬG`l/) E'b& >V!!# G`l/)(( $Ϭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ЬG`l/) E'b& >V!!# G`l/)(( $Ь ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ѬG`l/) E'b& >V!!# G`l/)(( $Ѭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ҬG`l/) E'b& >V!!# G`l/)(( $Ҭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ӬG`l/) E'b& >V!!# G`l/)(( $Ӭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ԬG`l/) E'b& >V!!# G`l/)(( $Ԭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**լG`l/) E'b& >V!!# G`l/)(( $լ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0֬G`l/) E'b& >V!!# G`l/)(( $֬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789!l0**׬G`l/) E'b& >V!!# G`l/)(( $׬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-l**جG`l/) E'b& >V!!# G`l/)(( $ج ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2l**٬G`l/) E'b& >V!!# G`l/)(( $٬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ڬG`l/) E'b& >V!!# G`l/)(( $ڬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ۬G`l/) E'b& >V!!# G`l/)(( $۬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **ܬG`l/) E'b& >V!!# G`l/)(( $ܬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ݬG`l/) E'b& >V!!# G`l/)(( $ݬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ެG`l/) E'b& >V!!# G`l/)(( $ެ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**߬G`l/) E'b& >V!!# G`l/)(( $߬ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(G`l/) E'b& >V!!# G`l/)(( $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $**0ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789vm0**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-m**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2m**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0** **ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ЄW1) E'b& >V!!# ЄW1)(Ƚ(  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,>V E'b& >VMicrosoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .ElfChnkyyxĊ}Dl=f?mMF8&**Ee[2) E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00** Ee[2) E'b& >V!!# Ee[2)(ὄ(4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0 Ee[2) E'b& >V!!# Ee[2)(ὄ(4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0** Ee[2) E'b& >V!!# Ee[2)(ὄ(4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h** Ee[2) E'b& >V!!# Ee[2)(ὄ(4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h** Ee[2) E'b& >V!!# Ee[2)(ὄ(4  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,a** Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy(**@Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyroso@**0Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss ttws-I0** Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMft-W ** Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMindo **Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6o**Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0o**(Ee[2) E'b& >V!!# Ee[2)(ὄ(4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyyr(**@Ր) E'b& >V!!# Ր))')d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ286Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1@**Ր) E'b& >V!!# Ր))')d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**Ր) E'b& >V!!# Ր))')d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**Ր) E'b& >V!!# Ր))')d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,**  Ր) E'b& >V!!# Ր))')d  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **!Ր) E'b& >V!!# Ր))')d! ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**"Ր) E'b& >V!!# Ր))')d" ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**#Ր) E'b& >V!!# Ր))')d# ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0$Ր) E'b& >V!!# Ր))')d$ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**%Ր) E'b& >V!!# Ր))')d% ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**&Ր) E'b& >V!!# Ր))')d& ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**'Ր) E'b& >V!!# Ր))')d' ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**(Ր) E'b& >V!!# Ր))')d( ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** )Ր) E'b& >V!!# Ր))')d) ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow ***Ր) E'b& >V!!# Ր))')d* ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**+Ր) E'b& >V!!# Ր))')d+ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**,Ր) E'b& >V!!# Ր))')d, ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**-Ր) E'b& >V!!# Ր))')d- ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(.Ր) E'b& >V!!# Ր))')d. ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@/Ր) E'b& >V!!# Ր))')d/ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**00Ր) E'b& >V!!# Ր))')d0 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** 1Ր) E'b& >V!!# Ր))')d1 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** 2Ր) E'b& >V!!# Ր))')d2 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **3Ր) E'b& >V!!# Ր))')d3 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**4Ր) E'b& >V!!# Ր))')d4 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(5Ր) E'b& >V!!# Ր))')d5 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** 6ra) E'b& >V!!# ra))"()<6 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **7ra) E'b& >V!!# ra))"()<7 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**8ra) E'b& >V!!# ra))"()<8 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**9ra) E'b& >V!!# ra))"()<9 ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** :ra) E'b& >V!!# ra))"()<: ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **;ra) E'b& >V!!# ra))"()<; ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**<ra) E'b& >V!!# ra))"()<< ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**=ra) E'b& >V!!# ra))"()<= ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0>ra) E'b& >V!!# ra))"()<> ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**?ra) E'b& >V!!# ra))"()<? ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**@ra) E'b& >V!!# ra))"()<@ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**Ara) E'b& >V!!# ra))"()<A ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**Bra) E'b& >V!!# ra))"()<B ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** Cra) E'b& >V!!# ra))"()<C ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **Dra) E'b& >V!!# ra))"()<D ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**Era) E'b& >V!!# ra))"()<E ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**Fra) E'b& >V!!# ra))"()<F ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**Gra) E'b& >V!!# ra))"()<G ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(Hra) E'b& >V!!# ra))"()<H ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@Ira) E'b& >V!!# ra))"()<I ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0Jra) E'b& >V!!# ra))"()<J ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** Kra) E'b& >V!!# ra))"()<K ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** Lra) E'b& >V!!# ra))"()<L ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **Mra) E'b& >V!!# ra))"()<M ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**Nra) E'b& >V!!# ra))"()<N ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(Ora) E'b& >V!!# ra))"()<O ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** PM) E'b& >V!!# M));()`P ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **QM) E'b& >V!!# M));()`Q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**RM) E'b& >V!!# M));()`R ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**SM) E'b& >V!!# M));()`S ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** TM) E'b& >V!!# M));()`T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **UM) E'b& >V!!# M));()`U ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**VM) E'b& >V!!# M));()`V ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**WM) E'b& >V!!# M));()`W ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0XM) E'b& >V!!# M));()`X ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**YM) E'b& >V!!# M));()`Y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**ZM) E'b& >V!!# M));()`Z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**[M) E'b& >V!!# M));()`[ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**\M) E'b& >V!!# M));()`\ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** ]M) E'b& >V!!# M));()`] ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **^M) E'b& >V!!# M));()`^ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**_M) E'b& >V!!# M));()`_ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+w**`M) E'b& >V!!# M));()`` ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w**aM) E'b& >V!!# M));()`a ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :i**(bM) E'b& >V!!# M));()`b ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyyow(**@cM) E'b& >V!!# M));()`c ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyyersh@**0dM) E'b& >V!!# M));()`d ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt 0** eM) E'b& >V!!# M));()`e ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AMell. ** fM) E'b& >V!!# M));()`f ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PMexe **gM) E'b& >V!!# M));()`g ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**hM) E'b& >V!!# M));()`h ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(iM) E'b& >V!!# M));()`i ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** jT6a, E'b& >V!!# T6a,Pd#,Pd#, $j ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ28 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **kT6a, E'b& >V!!# T6a,Pd#,Pd#, $k ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**lT6a, E'b& >V!!# T6a,Pd#,Pd#, $l ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**mT6a, E'b& >V!!# T6a,Pd#,Pd#, $m ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** nT6a, E'b& >V!!# T6a,Pd#,Pd#, $n ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0yyy **oT6a, E'b& >V!!# T6a,Pd#,Pd#, $o ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**pT6a, E'b& >V!!# T6a,Pd#,Pd#, $p ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 00**qT6a, E'b& >V!!# T6a,Pd#,Pd#, $q ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $w**0r!9a, E'b& >V!!# !9a,Pd#,Pd#, $r ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789ell\0**s!9a, E'b& >V!!# !9a,Pd#,Pd#, $s ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-h**t!9a, E'b& >V!!# !9a,Pd#,Pd#, $t ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2h**u!9a, E'b& >V!!# !9a,Pd#,Pd#, $u ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .h**v!9a, E'b& >V!!# !9a,Pd#,Pd#, $v ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,3** w!9a, E'b& >V!!# !9a,Pd#,Pd#, $w ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0dow **x!9a, E'b& >V!!# !9a,Pd#,Pd#, $x ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1w**y!9a, E'b& >V!!# !9a,Pd#,Pd#, $y ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+wowerShell\v1 E'b& >VE'b!# !9a,Pd#,Pd#, $z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ElfChnkzz2:*Dl=f?mMF&**z!9a, E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! >V!!# !9a,Pd#,Pd#, $z ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational ..Ŀ[9T&DD EventDataA;loData= ProcessId A-l= ProdessName A#l=Locale A#l=LCType A'l=lpLCData t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**{!9a, E'b& >V!!# !9a,Pd#,Pd#, ${ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(|!9a, E'b& >V!!# !9a,Pd#,Pd#, $| ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@}!9a, E'b& >V!!# !9a,Pd#,Pd#, $} ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0~!9a, E'b& >V!!# !9a,Pd#,Pd#, $~ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** !9a, E'b& >V!!# !9a,Pd#,Pd#, $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** !9a, E'b& >V!!# !9a,Pd#,Pd#, $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **!9a, E'b& >V!!# !9a,Pd#,Pd#, $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**!9a, E'b& >V!!# !9a,Pd#,Pd#, $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(!9a, E'b& >V!!# !9a,Pd#,Pd#, $ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(**@,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ26Ƣ2EìJE킿WDA+l= LocaleName A!l=Flags A)l= ProcessId A-l= ProdessName A+l= ReturnCode  ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exenal @**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 **,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . **,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , ** ,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0tio **,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0n**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0f**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $r**0,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789t-Wi0**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-i**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2i**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .r**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(,a, E'b& >V!!# ,a,Pd#,Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ra, E'b& >V!!# ra,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 012345678930**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(rta, E'b& >V!!# rta,Pd#, Pd#,  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-USC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789M0**?. E'b& >V!!# ?.m~.`m~.  ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**­?. E'b& >V!!# ?.m~.`m~. ­ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**í?. E'b& >V!!# ?.m~.`m~. í ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ĭ?. E'b& >V!!# ?.m~.`m~. ĭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ŭ?. E'b& >V!!# ?.m~.`m~. ŭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **ƭ?. E'b& >V!!# ?.m~.`m~. ƭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**ǭ?. E'b& >V!!# ?.m~.`m~. ǭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**ȭ?. E'b& >V!!# ?.m~.`m~. ȭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**ɭ?. E'b& >V!!# ?.m~.`m~. ɭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(ʭ?. E'b& >V!!# ?.m~.`m~. ʭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@˭iA. E'b& >V!!# iA.m~.`m~. ˭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t&C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0̭iA. E'b& >V!!# iA.m~.`m~. ̭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ͭiA. E'b& >V!!# iA.m~.`m~. ͭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** έiA. E'b& >V!!# iA.m~.`m~. έ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **ϭiA. E'b& >V!!# iA.m~.`m~. ϭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**ЭiA. E'b& >V!!# iA.m~.`m~. Э ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(ѭiA. E'b& >V!!# iA.m~.`m~. ѭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .tC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** ҭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tҭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **ӭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tӭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ԭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tԭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**խ;Aj. E'b& >V!!# ;Aj.m~.m~. Tխ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ֭;Aj. E'b& >V!!# ;Aj.m~.m~. T֭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **׭;Aj. E'b& >V!!# ;Aj.m~.m~. T׭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**ح;Aj. E'b& >V!!# ;Aj.m~.m~. Tح ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0**٭;Aj. E'b& >V!!# ;Aj.m~.m~. T٭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $.**0ڭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tڭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 0123456789g0**ۭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tۭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Q-**ܭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tܭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2**ݭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tݭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .**ޭ;Aj. E'b& >V!!# ;Aj.m~.m~. Tޭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ,** ߭;Aj. E'b& >V!!# ;Aj.m~.m~. T߭ ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 3;0 **;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1**;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe P+**;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /**;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe :**(;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe M/d/yyyy*(**@;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t& C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  dddd, MMMM d, yyyy@**0;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe h:mm:ss tt0** ;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (AM ** ;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe )PM **;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  6**;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe  0**(;Aj. E'b& >V!!# ;Aj.m~.m~. T ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MMMM yyyy(** r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational 6Ƣ2 ten-US C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe **r. E'b& >V!!# r.m~.m~.   ذĤi 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational .t C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2 > E'b& >V 2Microsoft-Windows-International+:WcL.?w;Microsoft-Windows-International/Operational