(ScriptBlockText:DumpCreds* ScriptBlockText:DumpCerts*) OR ScriptBlockText:sekurlsa\:\:logonpasswords* OR (ScriptBlockText:crypto\:\:certificates* ScriptBlockText:CERT_SYSTEM_STORE_LOCAL_MACHINE*)