Payload:\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[ OR Payload:\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[ OR Payload:\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[ OR Payload:\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2} OR Payload:\\*mdr\\*\\W\\s*\\)\\.Name OR Payload:\\$VerbosePreference\\.ToString\\( OR Payload:\\[String\\]\\s*\\$VerbosePreference