cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

added training

Browse Source
This commit is contained in:
cato447
2026-03-09 21:48:34 +01:00
parent d1017bae51
commit d81f8a611f
110 changed files with 4393 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
training/srdnlenctf-2025/dfir_malvent/al_Application.evtx Normal file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/dfir_malvent/al_Security.evtx Normal file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/dfir_malvent/al_System.evtx Normal file
View File

Binary file not shown.

588
training/srdnlenctf-2025/dfir_malvent/security.json Normal file
View File

@@ -0,0 +1,588 @@
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4616,"Version":1,"Level":0,"Task":12288,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078323Z"}},"EventRecordID":20943,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","PreviousTime":"2025-01-04T05:01:04.678857Z","NewTime":"2025-01-03T21:01:07.078000Z","ProcessId":"0x5bc","ProcessName":"C:\\Windows\\System32\\VBoxService.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.112776Z"}},"EventRecordID":20944,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.112782Z"}},"EventRecordID":20945,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.123821Z"}},"EventRecordID":20946,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.123826Z"}},"EventRecordID":20947,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.137037Z"}},"EventRecordID":20948,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.137042Z"}},"EventRecordID":20949,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.187752Z"}},"EventRecordID":20950,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.187758Z"}},"EventRecordID":20951,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.352454Z"}},"EventRecordID":20952,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.352460Z"}},"EventRecordID":20953,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.435480Z"}},"EventRecordID":20954,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.435488Z"}},"EventRecordID":20955,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.439067Z"}},"EventRecordID":20956,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.439073Z"}},"EventRecordID":20957,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.454940Z"}},"EventRecordID":20958,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.454944Z"}},"EventRecordID":20959,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.457666Z"}},"EventRecordID":20960,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.457671Z"}},"EventRecordID":20961,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.504493Z"}},"EventRecordID":20962,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.504499Z"}},"EventRecordID":20963,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5033,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.532739Z"}},"EventRecordID":20964,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.592783Z"}},"EventRecordID":20965,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.592790Z"}},"EventRecordID":20966,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.593504Z"}},"EventRecordID":20967,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.593508Z"}},"EventRecordID":20968,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.595525Z"}},"EventRecordID":20969,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.595530Z"}},"EventRecordID":20970,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.607375Z"}},"EventRecordID":20971,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.607381Z"}},"EventRecordID":20972,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.624340Z"}},"EventRecordID":20973,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.624345Z"}},"EventRecordID":20974,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.629097Z"}},"EventRecordID":20975,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.629104Z"}},"EventRecordID":20976,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.634310Z"}},"EventRecordID":20977,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.634316Z"}},"EventRecordID":20978,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.635588Z"}},"EventRecordID":20979,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.635593Z"}},"EventRecordID":20980,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.636979Z"}},"EventRecordID":20981,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.636986Z"}},"EventRecordID":20982,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.641818Z"}},"EventRecordID":20983,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.641823Z"}},"EventRecordID":20984,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.669706Z"}},"EventRecordID":20985,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.669750Z"}},"EventRecordID":20986,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.715196Z"}},"EventRecordID":20987,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0xc38","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.717388Z"}},"EventRecordID":20988,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0xc38","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.765295Z"}},"EventRecordID":20989,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcc0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.765871Z"}},"EventRecordID":20990,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcc0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.770811Z"}},"EventRecordID":20991,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.770817Z"}},"EventRecordID":20992,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.802768Z"}},"EventRecordID":20993,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc94","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.802823Z"}},"EventRecordID":20994,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.802829Z"}},"EventRecordID":20995,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.803058Z"}},"EventRecordID":20996,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc94","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.931264Z"}},"EventRecordID":20997,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.931271Z"}},"EventRecordID":20998,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.576651Z"}},"EventRecordID":20999,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.576659Z"}},"EventRecordID":21000,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.614464Z"}},"EventRecordID":21001,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.614472Z"}},"EventRecordID":21002,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.928598Z"}},"EventRecordID":21003,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x5c4","CallerProcessName":"C:\\Windows\\System32\\LogonUI.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5024,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.979157Z"}},"EventRecordID":21004,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.057088Z"}},"EventRecordID":21005,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.057093Z"}},"EventRecordID":21006,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.286059Z"}},"EventRecordID":21007,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.286065Z"}},"EventRecordID":21008,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.329460Z"}},"EventRecordID":21009,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02jcokiuqaihmliq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.329661Z"}},"EventRecordID":21010,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02jcokiuqaihmliq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.329718Z"}},"EventRecordID":21011,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.177215Z"}},"EventRecordID":21012,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.177414Z"}},"EventRecordID":21013,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.177461Z"}},"EventRecordID":21014,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4625,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8010000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:15.070678Z"}},"EventRecordID":21015,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","Status":"0xc000006e","FailureReason":"%%2309","SubStatus":"0xc0000071","LogonType":2,"LogonProcessName":"User32 ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x84c","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4723,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.083427Z"}},"EventRecordID":21016,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","PrivilegeList":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.123632Z"}},"EventRecordID":21017,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x330","ProcessName":"C:\\Windows\\System32\\lsass.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.123647Z"}},"EventRecordID":21018,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x5fbad","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x330","ProcessName":"C:\\Windows\\System32\\lsass.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.123676Z"}},"EventRecordID":21019,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5fbad","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.165955Z"}},"EventRecordID":21020,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x6d0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4634,"Version":0,"Level":0,"Task":12545,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.282978Z"}},"EventRecordID":21021,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x5fbad","LogonType":2}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.309389Z"}},"EventRecordID":21022,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.309396Z"}},"EventRecordID":21023,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5382,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.849901Z"}},"EventRecordID":21024,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","SchemaFriendlyName":"NGC Local Accoount Logon Vault Resource Schema","Schema":"1D4350A3-330D-4AF9-B3FF-A927A45998AC","Resource":"NGC Local Accoount Logon Vault Resource","Identity":"0105000000000005150000006DA8856DCAC92779BFB554B4E8030000","PackageSid":"","Flags":0,"ReturnCode":1168,"ProcessCreationTime":"2025-01-03T21:01:20.310315Z","ClientProcessId":5152}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.922337Z"}},"EventRecordID":21025,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x84c","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.922351Z"}},"EventRecordID":21026,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x65dd3","LogonType":2,"LogonProcessName":"User32 ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x84c","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.922356Z"}},"EventRecordID":21027,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.947282Z"}},"EventRecordID":21028,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.959008Z"}},"EventRecordID":21029,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x6d0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.991851Z"}},"EventRecordID":21030,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.991861Z"}},"EventRecordID":21031,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.137344Z"}},"EventRecordID":21032,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","ClientProcessId":5312,"ClientCreationTime":"2025-01-03T21:01:24.013778Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Users\\User\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.138392Z"}},"EventRecordID":21033,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.138709Z"}},"EventRecordID":21034,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","ClientProcessId":5312,"ClientCreationTime":"2025-01-03T21:01:24.013778Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.170794Z"}},"EventRecordID":21035,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5732,"ClientCreationTime":"2025-01-03T21:01:24.143874Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.174949Z"}},"EventRecordID":21036,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.175405Z"}},"EventRecordID":21037,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5732,"ClientCreationTime":"2025-01-03T21:01:24.143874Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.286256Z"}},"EventRecordID":21038,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.286262Z"}},"EventRecordID":21039,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.831075Z"}},"EventRecordID":21040,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.840702Z"}},"EventRecordID":21041,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.840940Z"}},"EventRecordID":21042,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.841216Z"}},"EventRecordID":21043,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.844808Z"}},"EventRecordID":21044,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.844841Z"}},"EventRecordID":21045,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.845365Z"}},"EventRecordID":21046,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.849932Z"}},"EventRecordID":21047,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(token):name=02bgqvdxvxxqstyq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.850130Z"}},"EventRecordID":21048,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(cert):name=02bgqvdxvxxqstyq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.850163Z"}},"EventRecordID":21049,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.856937Z"}},"EventRecordID":21050,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02raxurszsovscdg;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.857209Z"}},"EventRecordID":21051,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02raxurszsovscdg;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.857311Z"}},"EventRecordID":21052,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.078874Z"}},"EventRecordID":21053,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.078919Z"}},"EventRecordID":21054,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.079224Z"}},"EventRecordID":21055,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.145587Z"}},"EventRecordID":21056,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.145924Z"}},"EventRecordID":21057,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.148294Z"}},"EventRecordID":21058,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.148329Z"}},"EventRecordID":21059,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.303218Z"}},"EventRecordID":21060,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.303413Z"}},"EventRecordID":21061,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.303449Z"}},"EventRecordID":21062,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.629064Z"}},"EventRecordID":21063,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.629451Z"}},"EventRecordID":21064,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.630967Z"}},"EventRecordID":21065,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.630999Z"}},"EventRecordID":21066,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.939914Z"}},"EventRecordID":21067,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.939959Z"}},"EventRecordID":21068,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.940193Z"}},"EventRecordID":21069,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.100540Z"}},"EventRecordID":21070,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.116762Z"}},"EventRecordID":21071,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.132711Z"}},"EventRecordID":21072,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.132994Z"}},"EventRecordID":21073,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137069Z"}},"EventRecordID":21074,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137534Z"}},"EventRecordID":21075,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(token):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137642Z"}},"EventRecordID":21076,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(cert):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137672Z"}},"EventRecordID":21077,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.145069Z"}},"EventRecordID":21078,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.145393Z"}},"EventRecordID":21079,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.150847Z"}},"EventRecordID":21080,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.150881Z"}},"EventRecordID":21081,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.345685Z"}},"EventRecordID":21082,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.362786Z"}},"EventRecordID":21083,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.373585Z"}},"EventRecordID":21084,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.373847Z"}},"EventRecordID":21085,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.397119Z"}},"EventRecordID":21086,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.397172Z"}},"EventRecordID":21087,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.397660Z"}},"EventRecordID":21088,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.799772Z"}},"EventRecordID":21089,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.800091Z"}},"EventRecordID":21090,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.801040Z"}},"EventRecordID":21091,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.801074Z"}},"EventRecordID":21092,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.845394Z"}},"EventRecordID":21093,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.845399Z"}},"EventRecordID":21094,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.871917Z"}},"EventRecordID":21095,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.871922Z"}},"EventRecordID":21096,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.973818Z"}},"EventRecordID":21097,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.990754Z"}},"EventRecordID":21098,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.004151Z"}},"EventRecordID":21099,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.004615Z"}},"EventRecordID":21100,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.008410Z"}},"EventRecordID":21101,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.441830Z"}},"EventRecordID":21102,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.452937Z"}},"EventRecordID":21103,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.464093Z"}},"EventRecordID":21104,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.464313Z"}},"EventRecordID":21105,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.466972Z"}},"EventRecordID":21106,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.467008Z"}},"EventRecordID":21107,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(token):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.467182Z"}},"EventRecordID":21108,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(cert):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.878180Z"}},"EventRecordID":21109,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.882039Z"}},"EventRecordID":21110,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.883531Z"}},"EventRecordID":21111,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.883609Z"}},"EventRecordID":21112,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.116889Z"}},"EventRecordID":21113,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.116893Z"}},"EventRecordID":21114,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.213547Z"}},"EventRecordID":21115,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.213631Z"}},"EventRecordID":21116,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.214004Z"}},"EventRecordID":21117,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.554909Z"}},"EventRecordID":21118,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.555298Z"}},"EventRecordID":21119,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.556597Z"}},"EventRecordID":21120,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.556638Z"}},"EventRecordID":21121,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.354707Z"}},"EventRecordID":21122,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.354713Z"}},"EventRecordID":21123,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.155805Z"}},"EventRecordID":21124,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.155811Z"}},"EventRecordID":21125,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.398918Z"}},"EventRecordID":21126,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.398923Z"}},"EventRecordID":21127,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.193080Z"}},"EventRecordID":21128,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.193179Z"}},"EventRecordID":21129,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.193812Z"}},"EventRecordID":21130,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.485549Z"}},"EventRecordID":21131,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.529670Z"}},"EventRecordID":21132,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.547459Z"}},"EventRecordID":21133,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.547559Z"}},"EventRecordID":21134,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.048513Z"}},"EventRecordID":21135,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.048689Z"}},"EventRecordID":21136,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.049351Z"}},"EventRecordID":21137,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.401824Z"}},"EventRecordID":21138,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.401891Z"}},"EventRecordID":21139,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.402269Z"}},"EventRecordID":21140,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.541504Z"}},"EventRecordID":21141,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.549253Z"}},"EventRecordID":21142,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.563612Z"}},"EventRecordID":21143,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.563657Z"}},"EventRecordID":21144,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.695272Z"}},"EventRecordID":21145,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.695640Z"}},"EventRecordID":21146,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.696027Z"}},"EventRecordID":21147,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.988875Z"}},"EventRecordID":21148,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.989479Z"}},"EventRecordID":21149,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.991708Z"}},"EventRecordID":21150,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.991752Z"}},"EventRecordID":21151,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.009944Z"}},"EventRecordID":21152,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.010008Z"}},"EventRecordID":21153,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.167347Z"}},"EventRecordID":21154,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.169945Z"}},"EventRecordID":21155,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.171498Z"}},"EventRecordID":21156,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.175183Z"}},"EventRecordID":21157,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.178127Z"}},"EventRecordID":21158,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.178169Z"}},"EventRecordID":21159,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.422649Z"}},"EventRecordID":21160,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.422654Z"}},"EventRecordID":21161,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.547928Z"}},"EventRecordID":21162,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.547972Z"}},"EventRecordID":21163,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.548691Z"}},"EventRecordID":21164,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.753023Z"}},"EventRecordID":21165,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.759382Z"}},"EventRecordID":21166,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.761039Z"}},"EventRecordID":21167,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.761074Z"}},"EventRecordID":21168,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.951863Z"}},"EventRecordID":21169,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","CallerProcessId":"0x18b0","CallerProcessName":"C:\\Windows\\System32\\RuntimeBroker.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.952901Z"}},"EventRecordID":21170,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","CallerProcessId":"0x18b0","CallerProcessName":"C:\\Windows\\System32\\RuntimeBroker.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.767809Z"}},"EventRecordID":21171,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.767854Z"}},"EventRecordID":21172,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.768181Z"}},"EventRecordID":21173,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.787783Z"}},"EventRecordID":21174,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","CallerProcessId":"0x1c10","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.010781Z"}},"EventRecordID":21175,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.015515Z"}},"EventRecordID":21176,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.018441Z"}},"EventRecordID":21177,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.018488Z"}},"EventRecordID":21178,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.009024Z"}},"EventRecordID":21179,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:55.159410Z","ClientProcessId":9092}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.011991Z"}},"EventRecordID":21180,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.011995Z"}},"EventRecordID":21181,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.208350Z"}},"EventRecordID":21182,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:55.159410Z","ClientProcessId":9092}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:00.392580Z"}},"EventRecordID":21183,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x271c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:00.392903Z"}},"EventRecordID":21184,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x271c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:06.983810Z"}},"EventRecordID":21185,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:46.842617Z","ClientProcessId":7116}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:10.698453Z"}},"EventRecordID":21186,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"Microsoft_Windows_Shell_ZipFolder:filename=C:\\Users\\User\\Desktop\\ch2.zip","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:24.189943Z","ClientProcessId":5824}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.484345Z"}},"EventRecordID":21187,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDriveCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.484448Z"}},"EventRecordID":21188,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDrive-INTCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.562572Z"}},"EventRecordID":21189,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"SkyDrive Cached Credential","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.562688Z"}},"EventRecordID":21190,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"SkyDrive-INT Cached Credential","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.817019Z"}},"EventRecordID":21191,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDriveCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.817079Z"}},"EventRecordID":21192,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDrive-INTCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:16.479310Z"}},"EventRecordID":21193,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:16.003138Z","ClientProcessId":11004}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.339106Z"}},"EventRecordID":21194,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:17.159056Z","ClientProcessId":10428}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.458774Z"}},"EventRecordID":21195,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:16.003138Z","ClientProcessId":11004}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.724172Z"}},"EventRecordID":21196,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.724216Z"}},"EventRecordID":21197,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.724570Z"}},"EventRecordID":21198,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.945344Z"}},"EventRecordID":21199,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.949952Z"}},"EventRecordID":21200,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.951490Z"}},"EventRecordID":21201,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.951571Z"}},"EventRecordID":21202,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.990736Z"}},"EventRecordID":21203,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.990741Z"}},"EventRecordID":21204,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.994097Z"}},"EventRecordID":21205,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.994102Z"}},"EventRecordID":21206,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.023696Z"}},"EventRecordID":21207,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.023743Z"}},"EventRecordID":21208,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.024107Z"}},"EventRecordID":21209,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.072029Z"}},"EventRecordID":21210,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.072034Z"}},"EventRecordID":21211,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.079624Z"}},"EventRecordID":21212,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.079629Z"}},"EventRecordID":21213,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346204Z"}},"EventRecordID":21214,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346230Z"}},"EventRecordID":21215,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346241Z"}},"EventRecordID":21216,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346266Z"}},"EventRecordID":21217,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346468Z"}},"EventRecordID":21218,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346615Z"}},"EventRecordID":21219,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.497521Z"}},"EventRecordID":21220,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.497836Z"}},"EventRecordID":21221,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.499158Z"}},"EventRecordID":21222,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.499194Z"}},"EventRecordID":21223,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.715090Z"}},"EventRecordID":21224,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.715094Z"}},"EventRecordID":21225,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.773736Z"}},"EventRecordID":21226,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.774177Z"}},"EventRecordID":21227,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.775626Z"}},"EventRecordID":21228,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.775657Z"}},"EventRecordID":21229,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.779529Z"}},"EventRecordID":21230,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.779533Z"}},"EventRecordID":21231,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5382,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.852535Z"}},"EventRecordID":21232,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","SchemaFriendlyName":"NGC Local Accoount Logon Vault Resource Schema","Schema":"1D4350A3-330D-4AF9-B3FF-A927A45998AC","Resource":"NGC Local Accoount Logon Vault Resource","Identity":"0105000000000005150000006DA8856DCAC92779BFB554B4E8030000","PackageSid":"","Flags":0,"ReturnCode":1168,"ProcessCreationTime":"2025-01-03T21:04:32.780187Z","ClientProcessId":2936}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.093428Z"}},"EventRecordID":21233,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.093773Z"}},"EventRecordID":21234,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.096061Z"}},"EventRecordID":21235,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.096096Z"}},"EventRecordID":21236,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.309357Z"}},"EventRecordID":21237,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.309394Z"}},"EventRecordID":21238,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.309639Z"}},"EventRecordID":21239,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.766375Z"}},"EventRecordID":21240,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.769859Z"}},"EventRecordID":21241,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.771022Z"}},"EventRecordID":21242,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.771052Z"}},"EventRecordID":21243,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.054921Z"}},"EventRecordID":21244,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.054926Z"}},"EventRecordID":21245,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056168Z"}},"EventRecordID":21246,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056171Z"}},"EventRecordID":21247,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056480Z"}},"EventRecordID":21248,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056483Z"}},"EventRecordID":21249,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.058547Z"}},"EventRecordID":21250,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.058550Z"}},"EventRecordID":21251,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.059148Z"}},"EventRecordID":21252,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.059151Z"}},"EventRecordID":21253,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.061045Z"}},"EventRecordID":21254,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.061052Z"}},"EventRecordID":21255,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.207085Z"}},"EventRecordID":21256,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.207089Z"}},"EventRecordID":21257,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.725870Z"}},"EventRecordID":21258,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.725875Z"}},"EventRecordID":21259,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.759924Z"}},"EventRecordID":21260,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.759960Z"}},"EventRecordID":21261,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.760231Z"}},"EventRecordID":21262,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.003827Z"}},"EventRecordID":21263,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.004135Z"}},"EventRecordID":21264,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.005159Z"}},"EventRecordID":21265,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.005189Z"}},"EventRecordID":21266,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.359807Z"}},"EventRecordID":21267,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.359812Z"}},"EventRecordID":21268,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.914836Z"}},"EventRecordID":21269,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.914842Z"}},"EventRecordID":21270,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.936380Z"}},"EventRecordID":21271,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.936385Z"}},"EventRecordID":21272,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.844513Z"}},"EventRecordID":21273,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.844519Z"}},"EventRecordID":21274,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.161916Z"}},"EventRecordID":21275,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.161922Z"}},"EventRecordID":21276,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4647,"Version":0,"Level":0,"Task":12545,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.455344Z"}},"EventRecordID":21277,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x65dd3"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.600519Z"}},"EventRecordID":21278,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.600524Z"}},"EventRecordID":21279,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.627920Z"}},"EventRecordID":21280,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrator","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-500","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628039Z"}},"EventRecordID":21281,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"DefaultAccount","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-503","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628139Z"}},"EventRecordID":21282,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Guest","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-501","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628246Z"}},"EventRecordID":21283,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628357Z"}},"EventRecordID":21284,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"WDAGUtilityAccount","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-504","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Eventlog","Guid":"{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"}},"EventID":1100,"Version":0,"Level":4,"Task":103,"Opcode":0,"Keywords":"0x4020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.664228Z"}},"EventRecordID":21285,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":10528}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"UserData":{"ServiceShutdown":{"#attributes":{"xmlns":"http://manifests.microsoft.com/win/2004/08/windows/eventlog"}}}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.561876Z"}},"EventRecordID":21286,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.561881Z"}},"EventRecordID":21287,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704886Z"}},"EventRecordID":21288,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x68","NewProcessName":"Registry","TokenElevationType":"%%1936","ProcessId":"0x4","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4696,"Version":0,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704891Z"}},"EventRecordID":21289,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x3e7","TargetProcessId":"0x68","TargetProcessName":"Registry","ProcessId":"0x4","ProcessName":""}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4826,"Version":0,"Level":0,"Task":13573,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704893Z"}},"EventRecordID":21290,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","LoadOptions":"-","AdvancedOptions":"%%1843","ConfigAccessPolicy":"%%1846","RemoteEventLogging":"%%1843","KernelDebug":"%%1843","VsmLaunchType":"%%1849","TestSigning":"%%1843","FlightSigning":"%%1843","DisableIntegrityChecks":"%%1843","HypervisorLoadOptions":"-","HypervisorLaunchType":"%%1849","HypervisorDebug":"%%1843"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.705726Z"}},"EventRecordID":21291,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x1b8","NewProcessName":"C:\\Windows\\System32\\smss.exe","TokenElevationType":"%%1936","ProcessId":"0x4","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.964077Z"}},"EventRecordID":21292,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x1d4","NewProcessName":"C:\\Windows\\System32\\autochk.exe","TokenElevationType":"%%1936","ProcessId":"0x1b8","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.505287Z"}},"EventRecordID":21293,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x230","NewProcessName":"C:\\Windows\\System32\\smss.exe","TokenElevationType":"%%1936","ProcessId":"0x1b8","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.589655Z"}},"EventRecordID":21294,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x238","NewProcessName":"C:\\Windows\\System32\\csrss.exe","TokenElevationType":"%%1936","ProcessId":"0x230","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.652872Z"}},"EventRecordID":21295,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x278","NewProcessName":"C:\\Windows\\System32\\smss.exe","TokenElevationType":"%%1936","ProcessId":"0x1b8","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.654078Z"}},"EventRecordID":21296,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x280","NewProcessName":"C:\\Windows\\System32\\wininit.exe","TokenElevationType":"%%1936","ProcessId":"0x230","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.656961Z"}},"EventRecordID":21297,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x294","NewProcessName":"C:\\Windows\\System32\\csrss.exe","TokenElevationType":"%%1936","ProcessId":"0x278","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.671262Z"}},"EventRecordID":21298,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x2e4","NewProcessName":"C:\\Windows\\System32\\winlogon.exe","TokenElevationType":"%%1936","ProcessId":"0x278","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.689087Z"}},"EventRecordID":21299,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x310","NewProcessName":"C:\\Windows\\System32\\services.exe","TokenElevationType":"%%1936","ProcessId":"0x280","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\wininit.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.716403Z"}},"EventRecordID":21300,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x32c","NewProcessName":"C:\\Windows\\System32\\lsass.exe","TokenElevationType":"%%1936","ProcessId":"0x280","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\wininit.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":6417,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.747159Z"}},"EventRecordID":21301,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"ProcessId":"0x32c","ProcessName":"C:\\Windows\\System32\\lsass.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4608,"Version":0,"Level":0,"Task":12288,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.748314Z"}},"EventRecordID":21302,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.749434Z"}},"EventRecordID":21303,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":0,"LogonProcessName":"-","AuthenticationPackageName":"-","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x4","ProcessName":"","IpAddress":"-","IpPort":"-","ImpersonationLevel":"-","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4902,"Version":0,"Level":0,"Task":13568,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.809711Z"}},"EventRecordID":21304,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"PuaCount":0,"PuaPolicyId":"0x7872"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821417Z"}},"EventRecordID":21305,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":888}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"UMFD-0","TargetDomainName":"Font Driver Host","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x280","ProcessName":"C:\\Windows\\System32\\wininit.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821421Z"}},"EventRecordID":21306,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"UMFD-1","TargetDomainName":"Font Driver Host","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821428Z"}},"EventRecordID":21307,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":888}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-96-0-0","TargetUserName":"UMFD-0","TargetDomainName":"Font Driver Host","TargetLogonId":"0x7aa6","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x280","ProcessName":"C:\\Windows\\System32\\wininit.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1842","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1843"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821432Z"}},"EventRecordID":21308,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-96-0-1","TargetUserName":"UMFD-1","TargetDomainName":"Font Driver Host","TargetLogonId":"0x7a80","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1842","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1843"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821518Z"}},"EventRecordID":21309,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821528Z"}},"EventRecordID":21310,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.851655Z"}},"EventRecordID":21311,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-20","TargetUserName":"NETWORK SERVICE","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e4","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.851659Z"}},"EventRecordID":21312,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-20","SubjectUserName":"NETWORK SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e4","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.870095Z"}},"EventRecordID":21313,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.870099Z"}},"EventRecordID":21314,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.923701Z"}},"EventRecordID":21315,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.923705Z"}},"EventRecordID":21316,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.927929Z"}},"EventRecordID":21317,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-19","TargetUserName":"LOCAL SERVICE","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e5","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.927933Z"}},"EventRecordID":21318,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.958701Z"}},"EventRecordID":21319,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.958707Z"}},"EventRecordID":21320,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.983677Z"}},"EventRecordID":21321,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"DWM-1","TargetDomainName":"Window Manager","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.983688Z"}},"EventRecordID":21322,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-90-0-1","TargetUserName":"DWM-1","TargetDomainName":"Window Manager","TargetLogonId":"0xf47d","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1842","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.983690Z"}},"EventRecordID":21323,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-90-0-1","SubjectUserName":"DWM-1","SubjectDomainName":"Window Manager","SubjectLogonId":"0xf47d","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.986530Z"}},"EventRecordID":21324,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.986535Z"}},"EventRecordID":21325,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.040375Z"}},"EventRecordID":21326,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.040380Z"}},"EventRecordID":21327,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.072595Z"}},"EventRecordID":21328,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.072601Z"}},"EventRecordID":21329,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079319Z"}},"EventRecordID":21330,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079323Z"}},"EventRecordID":21331,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.110457Z"}},"EventRecordID":21332,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.110462Z"}},"EventRecordID":21333,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.247881Z"}},"EventRecordID":21334,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.247885Z"}},"EventRecordID":21335,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287146Z"}},"EventRecordID":21336,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287156Z"}},"EventRecordID":21337,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.328579Z"}},"EventRecordID":21338,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.328583Z"}},"EventRecordID":21339,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.329403Z"}},"EventRecordID":21340,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.329406Z"}},"EventRecordID":21341,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.333716Z"}},"EventRecordID":21342,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.333719Z"}},"EventRecordID":21343,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.360993Z"}},"EventRecordID":21344,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.360998Z"}},"EventRecordID":21345,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5033,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.380597Z"}},"EventRecordID":21346,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.400188Z"}},"EventRecordID":21347,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.400202Z"}},"EventRecordID":21348,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.427938Z"}},"EventRecordID":21349,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.427942Z"}},"EventRecordID":21350,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.429255Z"}},"EventRecordID":21351,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.429258Z"}},"EventRecordID":21352,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.431160Z"}},"EventRecordID":21353,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.431163Z"}},"EventRecordID":21354,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.432880Z"}},"EventRecordID":21355,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.432883Z"}},"EventRecordID":21356,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.445661Z"}},"EventRecordID":21357,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.445665Z"}},"EventRecordID":21358,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.470699Z"}},"EventRecordID":21359,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.470713Z"}},"EventRecordID":21360,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.472361Z"}},"EventRecordID":21361,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.472370Z"}},"EventRecordID":21362,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.484598Z"}},"EventRecordID":21363,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.484603Z"}},"EventRecordID":21364,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.486152Z"}},"EventRecordID":21365,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.486156Z"}},"EventRecordID":21366,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.496848Z"}},"EventRecordID":21367,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.496853Z"}},"EventRecordID":21368,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.521211Z"}},"EventRecordID":21369,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.521216Z"}},"EventRecordID":21370,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.551950Z"}},"EventRecordID":21371,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc54","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.552292Z"}},"EventRecordID":21372,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc54","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.576862Z"}},"EventRecordID":21373,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0x980","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.577141Z"}},"EventRecordID":21374,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0x980","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.609791Z"}},"EventRecordID":21375,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcb4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.610026Z"}},"EventRecordID":21376,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcb4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.671084Z"}},"EventRecordID":21377,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.671088Z"}},"EventRecordID":21378,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.712139Z"}},"EventRecordID":21379,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.712144Z"}},"EventRecordID":21380,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5024,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.228542Z"}},"EventRecordID":21381,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.277813Z"}},"EventRecordID":21382,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.277822Z"}},"EventRecordID":21383,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.288037Z"}},"EventRecordID":21384,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x554","CallerProcessName":"C:\\Windows\\System32\\LogonUI.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.463811Z"}},"EventRecordID":21385,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.463815Z"}},"EventRecordID":21386,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526637Z"}},"EventRecordID":21387,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526637Z"}},"EventRecordID":21388,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526642Z"}},"EventRecordID":21389,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526660Z"}},"EventRecordID":21390,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.552948Z"}},"EventRecordID":21391,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.552952Z"}},"EventRecordID":21392,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.569175Z"}},"EventRecordID":21393,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.569342Z"}},"EventRecordID":21394,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.569392Z"}},"EventRecordID":21395,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.572986Z"}},"EventRecordID":21396,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.573081Z"}},"EventRecordID":21397,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.573245Z"}},"EventRecordID":21398,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.044549Z"}},"EventRecordID":21399,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.045185Z"}},"EventRecordID":21400,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.046368Z"}},"EventRecordID":21401,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.046398Z"}},"EventRecordID":21402,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.804422Z"}},"EventRecordID":21403,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x7ec","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.804432Z"}},"EventRecordID":21404,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x5026c","LogonType":2,"LogonProcessName":"User32 ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x7ec","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.804436Z"}},"EventRecordID":21405,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.850594Z"}},"EventRecordID":21406,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x6c0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.881506Z"}},"EventRecordID":21407,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.881888Z"}},"EventRecordID":21408,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.881925Z"}},"EventRecordID":21409,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.887769Z"}},"EventRecordID":21410,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.887773Z"}},"EventRecordID":21411,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.061401Z"}},"EventRecordID":21412,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","ClientProcessId":4884,"ClientCreationTime":"2025-01-03T21:06:25.946171Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Users\\User\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.065790Z"}},"EventRecordID":21413,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.066071Z"}},"EventRecordID":21414,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","ClientProcessId":4884,"ClientCreationTime":"2025-01-03T21:06:25.946171Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.090920Z"}},"EventRecordID":21415,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5336,"ClientCreationTime":"2025-01-03T21:06:26.074773Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.095739Z"}},"EventRecordID":21416,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.095980Z"}},"EventRecordID":21417,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5336,"ClientCreationTime":"2025-01-03T21:06:26.074773Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.940672Z"}},"EventRecordID":21418,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.940677Z"}},"EventRecordID":21419,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.149034Z"}},"EventRecordID":21420,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.149039Z"}},"EventRecordID":21421,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.790495Z"}},"EventRecordID":21422,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.790500Z"}},"EventRecordID":21423,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.926810Z"}},"EventRecordID":21424,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1d98","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.927922Z"}},"EventRecordID":21425,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1d98","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:29.617458Z"}},"EventRecordID":21426,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:29.617463Z"}},"EventRecordID":21427,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:31.683111Z"}},"EventRecordID":21428,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:31.683116Z"}},"EventRecordID":21429,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:31.805903Z"}},"EventRecordID":21430,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:30.979870Z","ClientProcessId":7192}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:33.747302Z"}},"EventRecordID":21431,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:30.979870Z","ClientProcessId":7192}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.185686Z"}},"EventRecordID":21432,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.185692Z"}},"EventRecordID":21433,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.772716Z"}},"EventRecordID":21434,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.772721Z"}},"EventRecordID":21435,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:40.460501Z"}},"EventRecordID":21436,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:36.175470Z","ClientProcessId":9204}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:33.576016Z"}},"EventRecordID":21437,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:33.576028Z"}},"EventRecordID":21438,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.018269Z"}},"EventRecordID":21439,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.018275Z"}},"EventRecordID":21440,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.250863Z"}},"EventRecordID":21441,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.250918Z"}},"EventRecordID":21442,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.251340Z"}},"EventRecordID":21443,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.253172Z"}},"EventRecordID":21444,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.253216Z"}},"EventRecordID":21445,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.253563Z"}},"EventRecordID":21446,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.257778Z"}},"EventRecordID":21447,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.257827Z"}},"EventRecordID":21448,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.258026Z"}},"EventRecordID":21449,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.693784Z"}},"EventRecordID":21450,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.698153Z"}},"EventRecordID":21451,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.699672Z"}},"EventRecordID":21452,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.699733Z"}},"EventRecordID":21453,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.729731Z"}},"EventRecordID":21454,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.733369Z"}},"EventRecordID":21455,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.735056Z"}},"EventRecordID":21456,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.735148Z"}},"EventRecordID":21457,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.168092Z"}},"EventRecordID":21458,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.171922Z"}},"EventRecordID":21459,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.173300Z"}},"EventRecordID":21460,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.173368Z"}},"EventRecordID":21461,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.660814Z"}},"EventRecordID":21462,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x15b4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.661147Z"}},"EventRecordID":21463,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x15b4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.123290Z"}},"EventRecordID":21464,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.123296Z"}},"EventRecordID":21465,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.147711Z"}},"EventRecordID":21466,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.148208Z"}},"EventRecordID":21467,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.151146Z"}},"EventRecordID":21468,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.151150Z"}},"EventRecordID":21469,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.152716Z"}},"EventRecordID":21470,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.153146Z"}},"EventRecordID":21471,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.156235Z"}},"EventRecordID":21472,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.157205Z"}},"EventRecordID":21473,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.160541Z"}},"EventRecordID":21474,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.160991Z"}},"EventRecordID":21475,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:06.187671Z"}},"EventRecordID":21476,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:06.187676Z"}},"EventRecordID":21477,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:37.969804Z"}},"EventRecordID":21478,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:37.969812Z"}},"EventRecordID":21479,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:38.934590Z"}},"EventRecordID":21480,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:38.934595Z"}},"EventRecordID":21481,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:12:33.456438Z"}},"EventRecordID":21482,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:12:33.456442Z"}},"EventRecordID":21483,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:53.793118Z"}},"EventRecordID":21484,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Users","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-545","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x404","CallerProcessName":"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{375B9C6C-4C26-4F96-A729-87140DD827C6}\\EDGEMITMP_1B69D.tmp\\setup.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:54.591944Z"}},"EventRecordID":21485,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:54.591949Z"}},"EventRecordID":21486,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:14:27.198065Z"}},"EventRecordID":21487,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:14:27.198073Z"}},"EventRecordID":21488,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:21.992598Z"}},"EventRecordID":21489,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:21.992602Z"}},"EventRecordID":21490,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005181Z"}},"EventRecordID":21491,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005375Z"}},"EventRecordID":21492,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005717Z"}},"EventRecordID":21493,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005720Z"}},"EventRecordID":21494,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.008527Z"}},"EventRecordID":21495,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.008671Z"}},"EventRecordID":21496,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.011043Z"}},"EventRecordID":21497,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.011182Z"}},"EventRecordID":21498,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.012453Z"}},"EventRecordID":21499,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.012611Z"}},"EventRecordID":21500,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.695121Z"}},"EventRecordID":21501,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.695124Z"}},"EventRecordID":21502,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:24.122887Z"}},"EventRecordID":21503,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:24.122890Z"}},"EventRecordID":21504,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.096345Z"}},"EventRecordID":21505,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.096349Z"}},"EventRecordID":21506,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:40.046027Z"}},"EventRecordID":21507,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:40.046034Z"}},"EventRecordID":21508,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.240607Z"}},"EventRecordID":21509,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.240611Z"}},"EventRecordID":21510,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.193804Z"}},"EventRecordID":21511,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.193811Z"}},"EventRecordID":21512,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.209969Z"}},"EventRecordID":21513,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.209973Z"}},"EventRecordID":21514,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.075113Z"}},"EventRecordID":21515,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.075118Z"}},"EventRecordID":21516,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.520027Z"}},"EventRecordID":21517,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.520033Z"}},"EventRecordID":21518,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:13.450616Z"}},"EventRecordID":21519,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:13.450622Z"}},"EventRecordID":21520,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.796877Z"}},"EventRecordID":21521,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.796887Z"}},"EventRecordID":21522,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.926705Z"}},"EventRecordID":21523,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.926949Z"}},"EventRecordID":21524,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.927016Z"}},"EventRecordID":21525,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.935082Z"}},"EventRecordID":21526,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.935262Z"}},"EventRecordID":21527,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.935306Z"}},"EventRecordID":21528,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:19:26.172498Z"}},"EventRecordID":21529,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":9376}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:19:26.172506Z"}},"EventRecordID":21530,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":9376}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}

10
training/srdnlenctf-2025/dfir_malvent/src/Dockerfile Normal file
View File

@@ -0,0 +1,10 @@
FROM python:3.12.0a5-slim-bullseye
WORKDIR /usr/app/src
COPY ./evtx.py ./requirements.txt /usr/app/src/
RUN pip install --no-cache-dir -r requirements.txt
RUN apt update && apt install -y socat
EXPOSE 8888
CMD ["python", "./evtx.py"]

11
training/srdnlenctf-2025/dfir_malvent/src/docker-compose.yml Normal file
View File

@@ -0,0 +1,11 @@
version: "3"
services:
dfir1:
build:
context: ./
dockerfile: Dockerfile
container_name: dfir1
ports:
- "0.0.0.0:1984:8888"
restart: always

95
training/srdnlenctf-2025/dfir_malvent/src/evtx.py Normal file
View File

@@ -0,0 +1,95 @@
import asyncio
questions = [
{"question": "What is the name of the suspicious service installed?", "answer": "QcUcMElh"},
{"question": "From which process it has been generated? Give also the extension", "answer": "lmIcgUEQ.exe"},
{"question": "What is its event ID?", "answer": "7045"},
{"question": "Give the events IDs corresponding to unsecured data (e.g. cryptography). If more than one put a comma (e.g. 1, 2)", "answer": "15, 18"},
{"question": "Which event ID is related to the state of the account protection?", "answer": "16977"},
{"question": "Give the compromised CLSID stating that malicious code could be executed. If more than one, put a comma (e.g. str1, str2)", "answer": "Windows.SecurityCenter.SecurityAppBroker, Windows.SecurityCenter.WscBrokerManager"},
{"question": "What is the port number listening for remote control?", "answer": "3387"},
{"question": "Give the event ID related to the manipulation of specific data (e.g. registry key manipulation, deletion, creation, modification)", "answer": "16"},
{"question": "Give the application name whose corruption could depend from the malware. (First letter uppercase, add also the extension).", "answer": "Widgets.exe"},
{"question": "Is Windows Defender on?", "answer": "yes"},
{"question": "What is the event ID stating this?", "answer": "15"},
{"question": "Give the event ID related to the wrong management of different sessions and users in remote desktop", "answer": "6003"},
{"question": "Which event ID states that the malware could have read the credentials?", "answer": "5379"}
]
TIMEOUT = 60 # seconds
PORT = 8888
def welcome_message():
return ("\n" +
"##############################################\n" +
"# Welcome to DFIR.1 Malvent Challenge! #\n" +
"##############################################\n" +
"\n")
def challenge_instructions():
return ("In this challenge, you have to retrieve information from the given evtx files from al_evtx.zip \n" +
"You will answer a series of questions.\n" +
"Each correct answer will take you closer to the flag srdnlen{something}\n" +
"Good luck!\n\n")
async def handle_client(reader, writer):
addr = writer.get_extra_info('peername')
print(f"Client connected: {addr}")
try:
# Send welcome message with graphics
writer.write(welcome_message().encode())
await writer.drain()
# Send challenge instructions
writer.write(challenge_instructions().encode())
await writer.drain()
for q in questions:
while True:
writer.write((q["question"] + "\n").encode())
await writer.drain()
try:
answer = await asyncio.wait_for(reader.readline(), timeout=TIMEOUT)
answer = answer.decode().strip()
except asyncio.TimeoutError:
print(f"Client {addr} timed out.")
writer.write(b"Connection closed due to inactivity.\n")
await writer.drain()
writer.close()
await writer.wait_closed()
return
if answer.lower() == q["answer"].lower():
writer.write(b"Correct!\n")
await writer.drain()
break
else:
writer.write(b"Incorrect. Try again.\n")
await writer.drain()
writer.write(b"Congratulations! You have completed the quiz.\n")
writer.write(b"Here's your flag for Malvent: srdnlen{DFIR1:evtx4system_mngmnt&malwan}\n")
await writer.drain()
except Exception as e:
print(f"Error with client {addr}: {e}")
finally:
print(f"Client disconnected: {addr}")
writer.close()
await writer.wait_closed()
async def main():
server = await asyncio.start_server(handle_client, '0.0.0.0', PORT)
addr = server.sockets[0].getsockname()
print(f"Server running on {addr}")
async with server:
await server.serve_forever()
if __name__ == "__main__":
try:
asyncio.run(main())
except KeyboardInterrupt:
print("\nServer shutting down.")

1
training/srdnlenctf-2025/dfir_malvent/src/requirements.txt Normal file
View File

@@ -0,0 +1 @@
asyncio

282
training/srdnlenctf-2025/dfir_malvent/system.json Normal file
View File

@@ -0,0 +1,282 @@
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6009},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.148354Z"}},"EventRecordID":2778,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["10.00.","22621","","Multiprocessor Free","0"]},"Binary":null}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6005},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.148531Z"}},"EventRecordID":2779,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"E9070100050003001500010007008C000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6013},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.149800Z"}},"EventRecordID":2780,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","","","","6","60",""]},"Binary":"31002E003100000030000000570069006E0064006F0077007300200031003000200045006E007400650072007000720069007300650020004500760061006C0075006100740069006F006E000000310030002E0030002E003200320036003200310020004200750069006C0064002000320032003600320031002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000320032003600320031002E006E0069005F00720065006C0065006100730065002E003200320030003500300036002D00310032003500300000003600350065003800320035006500360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C00650000003900000034000000380031003700360000003400300039000000570069006E0044006500760032003400300031004500760061006C0000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":24,"Version":0,"Level":4,"Task":11,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078261Z"}},"EventRecordID":2849,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1468,"ThreadID":1652}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ExitReason":0,"CurrentBias":480,"CurrentTimeZoneID":1,"TimeZoneInfoCacheUpdated":0,"FirstRefresh":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":1,"Version":4,"Level":4,"Task":5,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078299Z"}},"EventRecordID":2850,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1468,"ThreadID":1652}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"NewTime":"2025-01-03T21:01:07.078000Z","OldTime":"2025-01-04T05:01:04.678857Z","TimeDeltaInMs":-28797600,"Reason":1,"ProcessName":"\\Device\\HarddiskVolume4\\Windows\\System32\\VBoxService.exe","ProcessID":1468,"CmosTime":"2025-01-03T13:01:07.078000Z","TimeZoneBias":480,"RealTimeIsUniversal":false,"SystemInCmosMode":false}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.104409Z"}},"EventRecordID":2851,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50103,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.104479Z"}},"EventRecordID":2852,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.105087Z"}},"EventRecordID":2853,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51046,"Version":0,"Level":4,"Task":4,"Opcode":62,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.115102Z"}},"EventRecordID":2854,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-VmSwitch","Guid":"67DC0D66-3695-47C0-9642-33F76F7BD7AD"}},"EventID":277,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.417292Z"}},"EventRecordID":2855,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BuildNumber":22621,"BuildArch":"amd64","BuildBranch":"ni_release_svc_prod1","Debug":false,"Official":true,"Date":"1","Time":"1"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501004Z"}},"EventRecordID":2856,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:5357/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501012Z"}},"EventRecordID":2857,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/Temporary_Listen_Addresses/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501017Z"}},"EventRecordID":2858,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://*:5358/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501023Z"}},"EventRecordID":2859,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:5986/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501029Z"}},"EventRecordID":2860,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:47001/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501033Z"}},"EventRecordID":2861,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:5985/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501036Z"}},"EventRecordID":2862,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:2869/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501042Z"}},"EventRecordID":2863,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501048Z"}},"EventRecordID":2864,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501053Z"}},"EventRecordID":2865,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501061Z"}},"EventRecordID":2866,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501065Z"}},"EventRecordID":2867,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:10245/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501070Z"}},"EventRecordID":2868,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10243/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501074Z"}},"EventRecordID":2869,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:3392/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501078Z"}},"EventRecordID":2870,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:3387/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501087Z"}},"EventRecordID":2871,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10246/MDEServer/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501091Z"}},"EventRecordID":2872,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10247/apps/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.566456Z"}},"EventRecordID":2873,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2832,"ThreadID":2932}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":119,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\DeliveryOptimization\\State\\dosvcState.dat","KeysUpdated":76,"DirtyPages":24}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7026},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.778908Z"}},"EventRecordID":2874,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":792}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"\r\ndam"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1796,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.119348Z"}},"EventRecordID":2875,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4284,"ThreadID":4728}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HResult":-2147020471}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.382205Z"}},"EventRecordID":2876,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3112,"ThreadID":4388}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":45,"HiveName":"\\??\\C:\\Windows\\AppCompat\\Programs\\Amcache.hve","KeysUpdated":2325,"DirtyPages":817}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":18,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.184716Z"}},"EventRecordID":2877,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":260}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x14","lineNumber":217,"Data":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.215298Z"}},"EventRecordID":2878,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.215465Z"}},"EventRecordID":2879,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.226672Z"}},"EventRecordID":2880,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.227571Z"}},"EventRecordID":2881,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1282,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.287657Z"}},"EventRecordID":2882,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1025,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.313894Z"}},"EventRecordID":2883,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.315613Z"}},"EventRecordID":2884,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.315666Z"}},"EventRecordID":2885,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.133492Z"}},"EventRecordID":2886,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1744,"ThreadID":1956}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":28,"HiveName":"\\??\\C:\\Users\\User\\ntuser.dat","KeysUpdated":708,"DirtyPages":135}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.146126Z"}},"EventRecordID":2887,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1744,"ThreadID":1956}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":62,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat","KeysUpdated":1308,"DirtyPages":173}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.237439Z"}},"EventRecordID":2888,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":63,"HiveName":"\\??\\C:\\Windows\\system32\\Microsoft\\Protect\\Recovery\\Recovery.dat","KeysUpdated":1,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7001,"Version":0,"Level":4,"Task":1101,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.931240Z"}},"EventRecordID":2889,"Correlation":null,"Execution":{"#attributes":{"ProcessID":720,"ThreadID":1460}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.566043Z"}},"EventRecordID":2890,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":35,"HiveName":"\\SystemRoot\\System32\\config\\DRIVERS","OriginalSize":5050368,"NewSize":4620288}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.957220Z"}},"EventRecordID":2891,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6192,"ThreadID":6248}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":103,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Time-Service","Guid":"06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB"}},"EventID":37,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.580202Z"}},"EventRecordID":2892,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6552,"ThreadID":6580}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"#attributes":{"Name":"TMP_EVENT_TIME_SOURCE_REACHABLE"},"TimeSource":"time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->20.101.57.9:123)"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.450059Z"}},"EventRecordID":2893,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":163,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.22621.3527_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.667668Z"}},"EventRecordID":2894,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":144,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.22700.1009.0_x64__cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.762020Z"}},"EventRecordID":2895,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":114,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.147101Z"}},"EventRecordID":2896,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":16,"DirtyPages":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.875957Z"}},"EventRecordID":2897,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:42.602012Z"}},"EventRecordID":2898,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":114,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":2,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:43.929450Z"}},"EventRecordID":2899,"Correlation":null,"Execution":{"#attributes":{"ProcessID":932,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":122,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\SystemAppData\\Helium\\User.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:43.930630Z"}},"EventRecordID":2900,"Correlation":null,"Execution":{"#attributes":{"ProcessID":932,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":129,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\SystemAppData\\Helium\\UserClasses.dat","KeysUpdated":4,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.487384Z"}},"EventRecordID":2901,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3716,"ThreadID":6996}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":118,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":9,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.425024Z"}},"EventRecordID":2902,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7116,"ThreadID":8208}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":91,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.078048Z"}},"EventRecordID":2903,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":106,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":2,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.241772Z"}},"EventRecordID":2904,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.245673Z"}},"EventRecordID":2905,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.294236Z"}},"EventRecordID":2906,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.298009Z"}},"EventRecordID":2907,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.343041Z"}},"EventRecordID":2908,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.346431Z"}},"EventRecordID":2909,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7040},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.230484Z"}},"EventRecordID":2910,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":3832}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"Background Intelligent Transfer Service","param2":"demand start","param3":"auto start","param4":"BITS"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:09.644669Z"}},"EventRecordID":2911,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":138,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:09.713664Z"}},"EventRecordID":2912,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":98,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.SecHealthUI_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:14.455660Z"}},"EventRecordID":2913,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":134,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ECApp_10.0.22621.3085_neutral__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:14.794814Z"}},"EventRecordID":2914,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":136,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.22621.3235_neutral__cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.398923Z"}},"EventRecordID":2915,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":94,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.932256Z"}},"EventRecordID":2916,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":92,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.ECApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:19.327624Z"}},"EventRecordID":2917,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:19.725704Z"}},"EventRecordID":2918,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Clipchamp.Clipchamp_yxz26nhyzhsrt\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:20.923837Z"}},"EventRecordID":2919,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:21.464825Z"}},"EventRecordID":2920,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.GamingApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:22.273320Z"}},"EventRecordID":2921,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":94,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.GetHelp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:23.228338Z"}},"EventRecordID":2922,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:23.697911Z"}},"EventRecordID":2923,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.098088Z"}},"EventRecordID":2924,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.502027Z"}},"EventRecordID":2925,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.RawImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.937414Z"}},"EventRecordID":2926,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":103,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.899331Z"}},"EventRecordID":2927,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:26.390335Z"}},"EventRecordID":2928,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WebpImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:26.783122Z"}},"EventRecordID":2929,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:27.240559Z"}},"EventRecordID":2930,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:27.740706Z"}},"EventRecordID":2931,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:28.374151Z"}},"EventRecordID":2932,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:28.715070Z"}},"EventRecordID":2933,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.075597Z"}},"EventRecordID":2934,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":102,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.495176Z"}},"EventRecordID":2935,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":110,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.857700Z"}},"EventRecordID":2936,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":111,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:30.733990Z"}},"EventRecordID":2937,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:31.335396Z"}},"EventRecordID":2938,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":99,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.ScreenSketch_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:32.179732Z"}},"EventRecordID":2939,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":101,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:32.878272Z"}},"EventRecordID":2940,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":99,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:33.471788Z"}},"EventRecordID":2941,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:33.790063Z"}},"EventRecordID":2942,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":102,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsTerminal_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:03:08.501739Z"}},"EventRecordID":2943,"Correlation":null,"Execution":{"#attributes":{"ProcessID":512,"ThreadID":8060}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.WscBrokerManager","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:03:08.501739Z"}},"EventRecordID":2944,"Correlation":null,"Execution":{"#attributes":{"ProcessID":512,"ThreadID":7212}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.SecurityAppBroker","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:00.246063Z"}},"EventRecordID":2945,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8532}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:14.096413Z"}},"EventRecordID":2946,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8532}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200,"serviceGuid":"9482F4B4-E343-43B6-B170-9A65BC822C77"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.674543Z"}},"EventRecordID":2947,"Correlation":null,"Execution":{"#attributes":{"ProcessID":8424,"ThreadID":8868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-20"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.675813Z"}},"EventRecordID":2948,"Correlation":null,"Execution":{"#attributes":{"ProcessID":8424,"ThreadID":8868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.377352Z"}},"EventRecordID":2949,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4724,"ThreadID":10156}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.975382Z"}},"EventRecordID":2950,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2328,"ThreadID":4916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":41,"HiveName":"\\??\\C:\\Windows\\System32\\config\\COMPONENTS","OriginalSize":54128640,"NewSize":33218560}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752214Z"}},"EventRecordID":2951,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752216Z"}},"EventRecordID":2952,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752216Z"}},"EventRecordID":2953,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:11.237540Z"}},"EventRecordID":2954,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":138,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WebMediaExtensions_1.1.1295.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:11.994590Z"}},"EventRecordID":2955,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8828}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.277449Z"}},"EventRecordID":2956,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.684519Z"}},"EventRecordID":2957,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0000-7A63-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8828}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.686759Z"}},"EventRecordID":2958,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":3796}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:13.154023Z"}},"EventRecordID":2959,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0003-503B-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":3796}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.037115Z"}},"EventRecordID":2960,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":131,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.611416Z"}},"EventRecordID":2961,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.611417Z"}},"EventRecordID":2962,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PB1QWVW0R95-Microsoft.WindowsAppRuntime.1.4","updateGuid":"95A66AB5-9220-40F7-8EEE-10325AA7534A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.955289Z"}},"EventRecordID":2963,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":2916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:16.320711Z"}},"EventRecordID":2964,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":97,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:16.827441Z"}},"EventRecordID":2965,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0000-857B-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":2916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:22.748567Z"}},"EventRecordID":2966,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":147,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:25.196535Z"}},"EventRecordID":2967,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:25.482570Z"}},"EventRecordID":2968,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:30.266934Z"}},"EventRecordID":2969,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":147,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x86__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:31.175265Z"}},"EventRecordID":2970,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-0963-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PKDZBMV1H3T-Microsoft.GetHelp","updateGuid":"0D3A7753-0583-485B-BFF6-989A4837D059","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:31.175267Z"}},"EventRecordID":2971,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-0963-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:33.955625Z"}},"EventRecordID":2972,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:33.959855Z"}},"EventRecordID":2973,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9076}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:34.501049Z"}},"EventRecordID":2974,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-2669-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9076}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.072922Z"}},"EventRecordID":2975,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NBLGGH4NNS1-Microsoft.DesktopAppInstaller","updateGuid":"3E695059-10D9-46E1-8684-4407B6814DC5","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.620285Z"}},"EventRecordID":2976,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.987651Z"}},"EventRecordID":2977,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-48A8-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:40.885033Z"}},"EventRecordID":2978,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NH2SW16MQ7F-Microsoft.WindowsAppRuntime.1.5","updateGuid":"8773522E-91D4-4492-BDE6-BBB32E34CC4E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7045},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.470679Z"}},"EventRecordID":2979,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":876}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"ServiceName":"Npcap Packet Driver (NPCAP)","ImagePath":"\\SystemRoot\\system32\\DRIVERS\\npcap.sys","ServiceType":"kernel mode driver","StartType":"system start","AccountName":""}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:51.384625Z"}},"EventRecordID":2980,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":146,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:05.805353Z"}},"EventRecordID":2981,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":146,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.5_5001.311.2039.0_x86__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"User32","Guid":"{b0aa8734-56f7-41cc-b2f4-de228e98b946}","EventSourceName":"User32"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":1074},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:07.647926Z"}},"EventRecordID":2982,"Correlation":null,"Execution":{"#attributes":{"ProcessID":572,"ThreadID":1160}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"param1":"C:\\Users\\User\\Downloads\\Wireshark-4.4.2-x64.exe (WINDEV2401EVAL)","param2":"WINDEV2401EVAL","param3":"Application: Installation (Planned)","param4":"0x80040002","param5":"restart","param6":"","param7":"WINDEV2401EVAL\\User"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:07.740334Z"}},"EventRecordID":2983,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N8MHTPHNGVV-Microsoft.Windows.DevHome","updateGuid":"9FDB0C59-6D48-4E86-A387-4CC86B6FB6E4","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7002,"Version":0,"Level":4,"Task":1102,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.626566Z"}},"EventRecordID":2984,"Correlation":null,"Execution":{"#attributes":{"ProcessID":720,"ThreadID":1460}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6006},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.674863Z"}},"EventRecordID":2985,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":10528}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"0100000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50104,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.672302Z"}},"EventRecordID":2986,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1628}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50105,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.672398Z"}},"EventRecordID":2987,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51047,"Version":0,"Level":4,"Task":4,"Opcode":63,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.679293Z"}},"EventRecordID":2988,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51057,"Version":0,"Level":4,"Task":4,"Opcode":104,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.679294Z"}},"EventRecordID":2989,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50106,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.692911Z"}},"EventRecordID":2990,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50037,"Version":0,"Level":4,"Task":4,"Opcode":69,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.692914Z"}},"EventRecordID":2991,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6009},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.076535Z"}},"EventRecordID":2992,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["10.00.","22621","","Multiprocessor Free","0"]},"Binary":null}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6005},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.077327Z"}},"EventRecordID":2993,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"E90701000500030015000600150043000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":109,"Version":0,"Level":4,"Task":103,"Opcode":0,"Keywords":"0x8000400000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:11.703012Z"}},"EventRecordID":2994,"Correlation":null,"Execution":{"#attributes":{"ProcessID":668,"ThreadID":672}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"ShutdownActionType":5,"ShutdownEventCode":0,"ShutdownReason":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":577,"Version":0,"Level":4,"Task":280,"Opcode":0,"Keywords":"0x8000000000000004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:12.243321Z"}},"EventRecordID":2995,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":3504}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"AdaptiveTargetState":0,"IsUnattended":false,"Status":279}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6013},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079006Z"}},"EventRecordID":2996,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","","","","5","60",""]},"Binary":"31002E003100000030000000570069006E0064006F0077007300200031003000200045006E007400650072007000720069007300650020004500760061006C0075006100740069006F006E000000310030002E0030002E003200320036003200310020004200750069006C0064002000320032003600320031002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000320032003600320031002E006E0069005F00720065006C0065006100730065002E003200320030003500300036002D00310032003500300000003600350065003800320035006500360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C00650000003900000034000000380031003700360000003400300039000000570069006E0044006500760032003400300031004500760061006C0000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":13,"Version":0,"Level":4,"Task":2,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:12.331834Z"}},"EventRecordID":2997,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":3504}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"StopTime":"2025-01-03T21:06:12.331832Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":12,"Version":0,"Level":4,"Task":1,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663484Z"}},"EventRecordID":2998,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"MajorVersion":10,"MinorVersion":0,"BuildVersion":22621,"QfeVersion":3733,"ServiceVersion":0,"BootMode":0,"StartTime":"2025-01-03T21:06:15.500000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":156,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663618Z"}},"EventRecordID":2999,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Status":3221225659,"EnableDisableReason":6,"VsmPolicy":515}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":20,"Version":1,"Level":4,"Task":31,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663728Z"}},"EventRecordID":3000,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"LastShutdownGood":true,"LastBootGood":true,"LastBootId":20,"BootStatusPolicy":2}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-Hypervisor","Guid":"52FC89F8-995E-434C-A91E-199986449890"}},"EventID":59,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000400000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663739Z"}},"EventRecordID":3001,"Correlation":{"#attributes":{"ActivityID":"8540B091-2DD0-04F9-BFE7-28DBC91AF0B7"}},"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":238,"Version":1,"Level":4,"Task":101,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3002,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"EfiTimeZoneBias":2047,"EfiDaylightFlags":0,"EfiTime":"2025-01-03T13:06:15.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":124,"Version":0,"Level":2,"Task":80,"Opcode":0,"Keywords":"0x8000480000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3003,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Phase":0,"Status":3221225659}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":25,"Version":0,"Level":4,"Task":32,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3004,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BootMenuPolicy":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":27,"Version":1,"Level":4,"Task":33,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663759Z"}},"EventRecordID":3005,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BootType":0,"LoadOptions":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2674688 NOVGA"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":18,"Version":0,"Level":4,"Task":57,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663798Z"}},"EventRecordID":3006,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"EntryCount":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":32,"Version":0,"Level":4,"Task":58,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663810Z"}},"EventRecordID":3007,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BitlockerUserInputTime":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":20,"Version":0,"Level":4,"Task":6,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.665083Z"}},"EventRecordID":3008,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"UpdateReason":0,"EnabledNew":true,"CountNew":0,"CountOld":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HAL","Guid":"63D1E632-95CC-4443-9312-AF927761D52A"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.706421Z"}},"EventRecordID":3009,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.730715Z"}},"EventRecordID":3010,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"FileInfo","DeviceTime":"2079-02-26T14:03:00.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.730942Z"}},"EventRecordID":3011,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":3,"DeviceName":"Wof","DeviceTime":"2086-08-04T03:20:16.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.731299Z"}},"EventRecordID":3012,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2055-04-20T12:48:29.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Ntfs","Guid":"3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482"}},"EventID":98,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000002","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.497029Z"}},"EventRecordID":3013,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriveName":"C:","DeviceName":"\\Device\\HarddiskVolume4","CorruptionActionState":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.533145Z"}},"EventRecordID":3014,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":9,"DeviceName":"FileCrypt","DeviceTime":"1983-08-18T18:58:35.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.536607Z"}},"EventRecordID":3015,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":4,"DeviceName":"UCPD","DeviceTime":"2053-03-18T03:17:45.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"VfpExt"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7036},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.620015Z"}},"EventRecordID":3016,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","Driver load start"]},"Binary":"0000000002002C00000000007C1B0040000000000000000000000000000000000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"VfpExt"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7036},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.620015Z"}},"EventRecordID":3017,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","Driver load complete"]},"Binary":"0000040002003000000000007C1B004000000000000000000000000000000000000000000000000057000600"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.665964Z"}},"EventRecordID":3018,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":9,"DeviceName":"npsvctrig","DeviceTime":"1979-12-19T08:12:41.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.697954Z"}},"EventRecordID":3019,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":172,"Version":0,"Level":4,"Task":203,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.700839Z"}},"EventRecordID":3020,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"State":2,"Reason":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-PnP","Guid":"9C205A39-1250-487D-ABD7-E831C6290539"}},"EventID":219,"Version":0,"Level":3,"Task":212,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704294Z"}},"EventRecordID":3021,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriverNameLength":15,"DriverName":"ROOT\\VMBus\\0000","Status":3221226341,"FailureNameLength":14,"FailureName":"\\Driver\\vmbusr","Version":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.924333Z"}},"EventRecordID":3022,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":0,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.924724Z"}},"EventRecordID":3023,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":1,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.925084Z"}},"EventRecordID":3024,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":2,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.925310Z"}},"EventRecordID":3025,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":3,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":521,"Version":0,"Level":4,"Task":220,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.926893Z"}},"EventRecordID":3026,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ValidBatteryCount":0,"ErrorBatteryCount":0,"AbandonedBatteryCount":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":521,"Version":0,"Level":4,"Task":220,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.927322Z"}},"EventRecordID":3027,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ValidBatteryCount":1,"ErrorBatteryCount":0,"AbandonedBatteryCount":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.968277Z"}},"EventRecordID":3028,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.969491Z"}},"EventRecordID":3029,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Ntfs","Guid":"3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482"}},"EventID":98,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000002","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.978503Z"}},"EventRecordID":3030,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriveName":"\\\\?\\Volume{ba579dec-23d5-4cef-9451-10d971c3ff1e}","DeviceName":"\\Device\\HarddiskVolume1","CorruptionActionState":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.982952Z"}},"EventRecordID":3031,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.310600Z"}},"EventRecordID":3032,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":516}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":36,"HiveName":"\\SystemRoot\\System32\\Config\\SOFTWARE","OriginalSize":109568000,"NewSize":109424640}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":24,"Version":0,"Level":4,"Task":11,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.338915Z"}},"EventRecordID":3033,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":548}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ExitReason":0,"CurrentBias":480,"CurrentTimeZoneID":1,"TimeZoneInfoCacheUpdated":0,"FirstRefresh":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.352677Z"}},"EventRecordID":3034,"Correlation":null,"Execution":{"#attributes":{"ProcessID":440,"ThreadID":444}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.617848Z"}},"EventRecordID":3035,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":524}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":35,"HiveName":"\\SystemRoot\\System32\\Config\\DEFAULT","KeysUpdated":276,"DirtyPages":47}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Wininit","Guid":"206F6DEA-D3C5-4D10-BC72-989F03C8B84B"}},"EventID":14,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.712596Z"}},"EventRecordID":3036,"Correlation":null,"Execution":{"#attributes":{"ProcessID":640,"ThreadID":644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Config":2,"IsTestConfig":0,"IsAutoEnabled":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Wininit","Guid":"206F6DEA-D3C5-4D10-BC72-989F03C8B84B"}},"EventID":15,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.712605Z"}},"EventRecordID":3037,"Correlation":null,"Execution":{"#attributes":{"ProcessID":640,"ThreadID":644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6156,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.729645Z"}},"EventRecordID":3038,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HardwareChecks":0,"ADDomainJoin":0,"AADDomainJoin":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.733964Z"}},"EventRecordID":3039,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":512}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":36,"HiveName":"\\SystemRoot\\System32\\Config\\SECURITY","KeysUpdated":76,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.752848Z"}},"EventRecordID":3040,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"negoexts"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.756158Z"}},"EventRecordID":3041,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"kerberos"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.764627Z"}},"EventRecordID":3042,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"msv1_0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.771357Z"}},"EventRecordID":3043,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"tspkg"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.772860Z"}},"EventRecordID":3044,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"pku2u"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.773658Z"}},"EventRecordID":3045,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"cloudap"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.793930Z"}},"EventRecordID":3046,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"wdigest"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.796492Z"}},"EventRecordID":3047,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"schannel"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.803487Z"}},"EventRecordID":3048,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"sfapm"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.803912Z"}},"EventRecordID":3049,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"msv1_0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16962,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.811181Z"}},"EventRecordID":3050,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_RESTRICT_REMOTE_SAM_DEFAULT_SD"},"Default SD String:":"O:SYG:SYD:(A;;RC;;;BA)"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.812265Z"}},"EventRecordID":3051,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":528}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":31,"HiveName":"\\SystemRoot\\System32\\Config\\SAM","KeysUpdated":67,"DirtyPages":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16977,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.814160Z"}},"EventRecordID":3052,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_MINPWDLEN_SETTINGS_IN_EFFECT"},"MinimumPasswordLength":0,"RelaxMinimumPasswordLengthLimits":0,"MinimumPasswordLengthAudit":-1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16983,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.814162Z"}},"EventRecordID":3053,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_OFF"}}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.853644Z"}},"EventRecordID":3054,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":56,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\NTUSER.DAT","KeysUpdated":86,"DirtyPages":15}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.925446Z"}},"EventRecordID":3055,"Correlation":null,"Execution":{"#attributes":{"ProcessID":936,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":31,"HiveName":"\\SystemRoot\\System32\\Config\\BBI","KeysUpdated":261,"DirtyPages":60}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.929613Z"}},"EventRecordID":3056,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":54,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\LocalService\\NTUSER.DAT","KeysUpdated":54,"DirtyPages":13}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.991595Z"}},"EventRecordID":3057,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":360}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":3,"DeviceName":"bfs","DeviceTime":"2013-09-13T20:21:10.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7000},"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.993283Z"}},"EventRecordID":3058,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":1400}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"luafv","param2":"%%1275","Binary":"6C0075006100660076000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.996806Z"}},"EventRecordID":3059,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":5,"DeviceName":"wcifs","DeviceTime":"2086-02-07T15:15:17.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001576Z"}},"EventRecordID":3060,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":1,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001580Z"}},"EventRecordID":3061,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001612Z"}},"EventRecordID":3062,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.017906Z"}},"EventRecordID":3063,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":10,"DeviceName":"storqosflt","DeviceTime":"2065-11-24T23:15:59.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.021714Z"}},"EventRecordID":3064,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":7,"DeviceName":"bindflt","DeviceTime":"2032-10-19T17:22:30.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.069426Z"}},"EventRecordID":3065,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50103,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.069455Z"}},"EventRecordID":3066,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.071720Z"}},"EventRecordID":3067,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51046,"Version":0,"Level":4,"Task":4,"Opcode":62,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.098069Z"}},"EventRecordID":3068,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1508}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-VmSwitch","Guid":"67DC0D66-3695-47C0-9642-33F76F7BD7AD"}},"EventID":277,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287850Z"}},"EventRecordID":3069,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BuildNumber":22621,"BuildArch":"amd64","BuildBranch":"ni_release_svc_prod1","Debug":false,"Official":true,"Date":"1","Time":"1"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359837Z"}},"EventRecordID":3070,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:5357/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359842Z"}},"EventRecordID":3071,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/Temporary_Listen_Addresses/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359845Z"}},"EventRecordID":3072,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://*:5358/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359849Z"}},"EventRecordID":3073,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:5986/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359852Z"}},"EventRecordID":3074,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:47001/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359855Z"}},"EventRecordID":3075,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:5985/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359859Z"}},"EventRecordID":3076,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:2869/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359862Z"}},"EventRecordID":3077,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359866Z"}},"EventRecordID":3078,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359869Z"}},"EventRecordID":3079,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359873Z"}},"EventRecordID":3080,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359876Z"}},"EventRecordID":3081,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:10245/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359879Z"}},"EventRecordID":3082,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10243/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359881Z"}},"EventRecordID":3083,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:3392/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359884Z"}},"EventRecordID":3084,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:3387/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359886Z"}},"EventRecordID":3085,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10246/MDEServer/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359890Z"}},"EventRecordID":3086,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10247/apps/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7026},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.571914Z"}},"EventRecordID":3087,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":788}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"\r\ndam"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1796,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.180226Z"}},"EventRecordID":3088,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3408,"ThreadID":1788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HResult":-2147020471}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":18,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.267544Z"}},"EventRecordID":3089,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":260}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x14","lineNumber":217,"Data":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.293761Z"}},"EventRecordID":3090,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.293840Z"}},"EventRecordID":3091,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.299555Z"}},"EventRecordID":3092,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.299892Z"}},"EventRecordID":3093,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1282,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.338441Z"}},"EventRecordID":3094,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1025,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.352043Z"}},"EventRecordID":3095,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.353661Z"}},"EventRecordID":3096,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.353759Z"}},"EventRecordID":3097,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7001,"Version":0,"Level":4,"Task":1101,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.810932Z"}},"EventRecordID":3098,"Correlation":null,"Execution":{"#attributes":{"ProcessID":740,"ThreadID":1356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.471891Z"}},"EventRecordID":3099,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.476676Z"}},"EventRecordID":3100,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.521187Z"}},"EventRecordID":3101,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.525912Z"}},"EventRecordID":3102,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.573798Z"}},"EventRecordID":3103,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":8084}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.577053Z"}},"EventRecordID":3104,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":8084}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:29.739956Z"}},"EventRecordID":3105,"Correlation":null,"Execution":{"#attributes":{"ProcessID":5344,"ThreadID":9616}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":117,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":279,"DirtyPages":24}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7045},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:47.870189Z"}},"EventRecordID":3106,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"ServiceName":"QcUcMElh","ImagePath":"C:\\ProgramData\\AQsYYssI\\lmIcgUEQ.exe","ServiceType":"user mode service","StartType":"auto start","AccountName":"LocalSystem"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:27.193836Z"}},"EventRecordID":3107,"Correlation":null,"Execution":{"#attributes":{"ProcessID":348,"ThreadID":572}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.WscBrokerManager","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:27.193836Z"}},"EventRecordID":3108,"Correlation":null,"Execution":{"#attributes":{"ProcessID":348,"ThreadID":572}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.SecurityAppBroker","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7034},"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:28.295782Z"}},"EventRecordID":3109,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":3764}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"Microsoft Update Health Service","param2":"1","Binary":"7500680073007300760063000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:03.977589Z"}},"EventRecordID":3110,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9424}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:03.979705Z"}},"EventRecordID":3111,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9424}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7040},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:29.757715Z"}},"EventRecordID":3112,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":2324}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"Background Intelligent Transfer Service","param2":"auto start","param3":"demand start","param4":"BITS"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.135574Z"}},"EventRecordID":3113,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.141019Z"}},"EventRecordID":3114,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.258142Z"}},"EventRecordID":3115,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.260234Z"}},"EventRecordID":3116,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.288656Z"}},"EventRecordID":3117,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.291483Z"}},"EventRecordID":3118,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:28.201509Z"}},"EventRecordID":3119,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":4644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:34.640841Z"}},"EventRecordID":3120,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":6724}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":1,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.094294Z"}},"EventRecordID":3121,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":360}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2055-04-20T12:48:29.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.956721Z"}},"EventRecordID":3122,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":552}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2072-04-25T20:11:39.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:46.035412Z"}},"EventRecordID":3123,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":6724}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200,"serviceGuid":"9482F4B4-E343-43B6-B170-9A65BC822C77"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.418796Z"}},"EventRecordID":3124,"Correlation":null,"Execution":{"#attributes":{"ProcessID":676,"ThreadID":2188}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":85,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-UserModePowerService","Guid":"CE8DEE0B-D539-4000-B0F8-77BED049C590"}},"EventID":22,"Version":0,"Level":4,"Task":18,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:57.609643Z"}},"EventRecordID":3125,"Correlation":null,"Execution":{"#attributes":{"ProcessID":936,"ThreadID":1060}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Turn":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:59.151881Z"}},"EventRecordID":3126,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:59.154395Z"}},"EventRecordID":3127,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}