cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
7934e8b473fd95fe1f63e9e235f90be4525fd72f
ctf/training/srdnlenctf-2025/dfir_malvent/system.json
cato447 d81f8a611f added training
2026-03-09 21:48:34 +01:00

283 lines
198 KiB
JSON
Raw Blame History

{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6009},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.148354Z"}},"EventRecordID":2778,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["10.00.","22621","","Multiprocessor Free","0"]},"Binary":null}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6005},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.148531Z"}},"EventRecordID":2779,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"E9070100050003001500010007008C000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6013},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.149800Z"}},"EventRecordID":2780,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":1732}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","","","","6","60",""]},"Binary":"31002E003100000030000000570069006E0064006F0077007300200031003000200045006E007400650072007000720069007300650020004500760061006C0075006100740069006F006E000000310030002E0030002E003200320036003200310020004200750069006C0064002000320032003600320031002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000320032003600320031002E006E0069005F00720065006C0065006100730065002E003200320030003500300036002D00310032003500300000003600350065003800320035006500360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C00650000003900000034000000380031003700360000003400300039000000570069006E0044006500760032003400300031004500760061006C0000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":24,"Version":0,"Level":4,"Task":11,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078261Z"}},"EventRecordID":2849,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1468,"ThreadID":1652}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ExitReason":0,"CurrentBias":480,"CurrentTimeZoneID":1,"TimeZoneInfoCacheUpdated":0,"FirstRefresh":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":1,"Version":4,"Level":4,"Task":5,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.078299Z"}},"EventRecordID":2850,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1468,"ThreadID":1652}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"NewTime":"2025-01-03T21:01:07.078000Z","OldTime":"2025-01-04T05:01:04.678857Z","TimeDeltaInMs":-28797600,"Reason":1,"ProcessName":"\\Device\\HarddiskVolume4\\Windows\\System32\\VBoxService.exe","ProcessID":1468,"CmosTime":"2025-01-03T13:01:07.078000Z","TimeZoneBias":480,"RealTimeIsUniversal":false,"SystemInCmosMode":false}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.104409Z"}},"EventRecordID":2851,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50103,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.104479Z"}},"EventRecordID":2852,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.105087Z"}},"EventRecordID":2853,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51046,"Version":0,"Level":4,"Task":4,"Opcode":62,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.115102Z"}},"EventRecordID":2854,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-VmSwitch","Guid":"67DC0D66-3695-47C0-9642-33F76F7BD7AD"}},"EventID":277,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.417292Z"}},"EventRecordID":2855,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":352}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BuildNumber":22621,"BuildArch":"amd64","BuildBranch":"ni_release_svc_prod1","Debug":false,"Official":true,"Date":"1","Time":"1"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501004Z"}},"EventRecordID":2856,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:5357/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501012Z"}},"EventRecordID":2857,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/Temporary_Listen_Addresses/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501017Z"}},"EventRecordID":2858,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://*:5358/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501023Z"}},"EventRecordID":2859,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:5986/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501029Z"}},"EventRecordID":2860,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:47001/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501033Z"}},"EventRecordID":2861,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:5985/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501036Z"}},"EventRecordID":2862,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:2869/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501042Z"}},"EventRecordID":2863,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501048Z"}},"EventRecordID":2864,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501053Z"}},"EventRecordID":2865,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501061Z"}},"EventRecordID":2866,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501065Z"}},"EventRecordID":2867,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:10245/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501070Z"}},"EventRecordID":2868,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10243/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501074Z"}},"EventRecordID":2869,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:3392/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501078Z"}},"EventRecordID":2870,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:3387/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501087Z"}},"EventRecordID":2871,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10246/MDEServer/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.501091Z"}},"EventRecordID":2872,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":224}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10247/apps/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.566456Z"}},"EventRecordID":2873,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2832,"ThreadID":2932}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":119,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\DeliveryOptimization\\State\\dosvcState.dat","KeysUpdated":76,"DirtyPages":24}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7026},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:07.778908Z"}},"EventRecordID":2874,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":792}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"\r\ndam"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1796,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.119348Z"}},"EventRecordID":2875,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4284,"ThreadID":4728}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HResult":-2147020471}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:09.382205Z"}},"EventRecordID":2876,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3112,"ThreadID":4388}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":45,"HiveName":"\\??\\C:\\Windows\\AppCompat\\Programs\\Amcache.hve","KeysUpdated":2325,"DirtyPages":817}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":18,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.184716Z"}},"EventRecordID":2877,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":260}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x14","lineNumber":217,"Data":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.215298Z"}},"EventRecordID":2878,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.215465Z"}},"EventRecordID":2879,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.226672Z"}},"EventRecordID":2880,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.227571Z"}},"EventRecordID":2881,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1282,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.287657Z"}},"EventRecordID":2882,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1025,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.313894Z"}},"EventRecordID":2883,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.315613Z"}},"EventRecordID":2884,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:11.315666Z"}},"EventRecordID":2885,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3312,"ThreadID":4292}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.133492Z"}},"EventRecordID":2886,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1744,"ThreadID":1956}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":28,"HiveName":"\\??\\C:\\Users\\User\\ntuser.dat","KeysUpdated":708,"DirtyPages":135}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.146126Z"}},"EventRecordID":2887,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1744,"ThreadID":1956}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":62,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat","KeysUpdated":1308,"DirtyPages":173}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:20.237439Z"}},"EventRecordID":2888,"Correlation":null,"Execution":{"#attributes":{"ProcessID":816,"ThreadID":852}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":63,"HiveName":"\\??\\C:\\Windows\\system32\\Microsoft\\Protect\\Recovery\\Recovery.dat","KeysUpdated":1,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7001,"Version":0,"Level":4,"Task":1101,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:23.931240Z"}},"EventRecordID":2889,"Correlation":null,"Execution":{"#attributes":{"ProcessID":720,"ThreadID":1460}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:24.566043Z"}},"EventRecordID":2890,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":35,"HiveName":"\\SystemRoot\\System32\\config\\DRIVERS","OriginalSize":5050368,"NewSize":4620288}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:26.957220Z"}},"EventRecordID":2891,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6192,"ThreadID":6248}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":103,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Time-Service","Guid":"06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB"}},"EventID":37,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:28.580202Z"}},"EventRecordID":2892,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6552,"ThreadID":6580}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"#attributes":{"Name":"TMP_EVENT_TIME_SOURCE_REACHABLE"},"TimeSource":"time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->20.101.57.9:123)"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.450059Z"}},"EventRecordID":2893,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":163,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.22621.3527_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.667668Z"}},"EventRecordID":2894,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":144,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.22700.1009.0_x64__cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:30.762020Z"}},"EventRecordID":2895,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":114,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:31.147101Z"}},"EventRecordID":2896,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":16,"DirtyPages":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:38.875957Z"}},"EventRecordID":2897,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:42.602012Z"}},"EventRecordID":2898,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":114,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":2,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:43.929450Z"}},"EventRecordID":2899,"Correlation":null,"Execution":{"#attributes":{"ProcessID":932,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":122,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\SystemAppData\\Helium\\User.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:43.930630Z"}},"EventRecordID":2900,"Correlation":null,"Execution":{"#attributes":{"ProcessID":932,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":129,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\\SystemAppData\\Helium\\UserClasses.dat","KeysUpdated":4,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:44.487384Z"}},"EventRecordID":2901,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3716,"ThreadID":6996}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":118,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":9,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:47.425024Z"}},"EventRecordID":2902,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7116,"ThreadID":8208}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":91,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:49.078048Z"}},"EventRecordID":2903,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":106,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":2,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.241772Z"}},"EventRecordID":2904,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.245673Z"}},"EventRecordID":2905,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.294236Z"}},"EventRecordID":2906,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.298009Z"}},"EventRecordID":2907,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.343041Z"}},"EventRecordID":2908,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:51.346431Z"}},"EventRecordID":2909,"Correlation":null,"Execution":{"#attributes":{"ProcessID":6252,"ThreadID":6244}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7040},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:01:56.230484Z"}},"EventRecordID":2910,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":3832}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"Background Intelligent Transfer Service","param2":"demand start","param3":"auto start","param4":"BITS"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:09.644669Z"}},"EventRecordID":2911,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":138,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:09.713664Z"}},"EventRecordID":2912,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":98,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.SecHealthUI_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:14.455660Z"}},"EventRecordID":2913,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":134,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ECApp_10.0.22621.3085_neutral__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:14.794814Z"}},"EventRecordID":2914,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":136,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.22621.3235_neutral__cw5n1h2txyewy\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.398923Z"}},"EventRecordID":2915,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":94,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:18.932256Z"}},"EventRecordID":2916,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":92,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.ECApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:19.327624Z"}},"EventRecordID":2917,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:19.725704Z"}},"EventRecordID":2918,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Clipchamp.Clipchamp_yxz26nhyzhsrt\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:20.923837Z"}},"EventRecordID":2919,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:21.464825Z"}},"EventRecordID":2920,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.GamingApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:22.273320Z"}},"EventRecordID":2921,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":94,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.GetHelp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:23.228338Z"}},"EventRecordID":2922,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:23.697911Z"}},"EventRecordID":2923,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.098088Z"}},"EventRecordID":2924,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.502027Z"}},"EventRecordID":2925,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.RawImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:24.937414Z"}},"EventRecordID":2926,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":103,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:25.899331Z"}},"EventRecordID":2927,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:26.390335Z"}},"EventRecordID":2928,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WebpImageExtension_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:26.783122Z"}},"EventRecordID":2929,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:27.240559Z"}},"EventRecordID":2930,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:27.740706Z"}},"EventRecordID":2931,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:28.374151Z"}},"EventRecordID":2932,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:28.715070Z"}},"EventRecordID":2933,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":96,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.075597Z"}},"EventRecordID":2934,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":102,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.495176Z"}},"EventRecordID":2935,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":110,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:29.857700Z"}},"EventRecordID":2936,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":111,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:30.733990Z"}},"EventRecordID":2937,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":100,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:31.335396Z"}},"EventRecordID":2938,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":99,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.ScreenSketch_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:32.179732Z"}},"EventRecordID":2939,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":101,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:32.878272Z"}},"EventRecordID":2940,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":99,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":5,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:33.471788Z"}},"EventRecordID":2941,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":107,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:02:33.790063Z"}},"EventRecordID":2942,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":102,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WindowsTerminal_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:03:08.501739Z"}},"EventRecordID":2943,"Correlation":null,"Execution":{"#attributes":{"ProcessID":512,"ThreadID":8060}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.WscBrokerManager","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:03:08.501739Z"}},"EventRecordID":2944,"Correlation":null,"Execution":{"#attributes":{"ProcessID":512,"ThreadID":7212}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.SecurityAppBroker","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:00.246063Z"}},"EventRecordID":2945,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8532}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:14.096413Z"}},"EventRecordID":2946,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8532}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1175.0) - Current Channel (Broad)","updateGuid":"ADF9EA27-820E-4C28-9E3A-0A3DA00FFB27","updateRevisionNumber":200,"serviceGuid":"9482F4B4-E343-43B6-B170-9A65BC822C77"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.674543Z"}},"EventRecordID":2947,"Correlation":null,"Execution":{"#attributes":{"ProcessID":8424,"ThreadID":8868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-20"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:32.675813Z"}},"EventRecordID":2948,"Correlation":null,"Execution":{"#attributes":{"ProcessID":8424,"ThreadID":8868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.377352Z"}},"EventRecordID":2949,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4724,"ThreadID":10156}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":104,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:04:37.975382Z"}},"EventRecordID":2950,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2328,"ThreadID":4916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":41,"HiveName":"\\??\\C:\\Windows\\System32\\config\\COMPONENTS","OriginalSize":54128640,"NewSize":33218560}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752214Z"}},"EventRecordID":2951,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752216Z"}},"EventRecordID":2952,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:06.752216Z"}},"EventRecordID":2953,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:11.237540Z"}},"EventRecordID":2954,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":138,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WebMediaExtensions_1.1.1295.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:11.994590Z"}},"EventRecordID":2955,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8828}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.277449Z"}},"EventRecordID":2956,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":105,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.684519Z"}},"EventRecordID":2957,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0000-7A63-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":8828}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N5TDP8VCMHS-Microsoft.WebMediaExtensions","updateGuid":"5319D8AB-5FD7-468E-B80D-9B78F53657B1","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:12.686759Z"}},"EventRecordID":2958,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":3796}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:13.154023Z"}},"EventRecordID":2959,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0003-503B-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":3796}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PG2DK419DRG-Microsoft.WebpImageExtension","updateGuid":"0D5A662D-006C-4DB0-9C9C-A6182CEF3EB1","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.037115Z"}},"EventRecordID":2960,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4196}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":131,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.611416Z"}},"EventRecordID":2961,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:14.611417Z"}},"EventRecordID":2962,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PB1QWVW0R95-Microsoft.WindowsAppRuntime.1.4","updateGuid":"95A66AB5-9220-40F7-8EEE-10325AA7534A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:15.955289Z"}},"EventRecordID":2963,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":2916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:16.320711Z"}},"EventRecordID":2964,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"HiveNameLength":97,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat","KeysUpdated":3,"DirtyPages":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:16.827441Z"}},"EventRecordID":2965,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0000-857B-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":2916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9WZDNCRDTBJJ-MICROSOFT.GETSTARTED","updateGuid":"9E6B27FE-F60B-44B4-8488-7F292F7C693D","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:22.748567Z"}},"EventRecordID":2966,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":147,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:25.196535Z"}},"EventRecordID":2967,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:25.482570Z"}},"EventRecordID":2968,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:30.266934Z"}},"EventRecordID":2969,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4280}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":147,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x86__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:31.175265Z"}},"EventRecordID":2970,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-0963-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PKDZBMV1H3T-Microsoft.GetHelp","updateGuid":"0D3A7753-0583-485B-BFF6-989A4837D059","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:31.175267Z"}},"EventRecordID":2971,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-0963-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N4WGH0Z6VHQ-Microsoft.HEVCVideoExtension","updateGuid":"467A6704-4B8F-42BE-9290-9A05BF1665BA","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:33.955625Z"}},"EventRecordID":2972,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:33.959855Z"}},"EventRecordID":2973,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9076}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:34.501049Z"}},"EventRecordID":2974,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0002-2669-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9076}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NCTDW2W1BH8-Microsoft.RawImageExtension","updateGuid":"0205D775-BAF7-4319-89BE-834A67AA709A","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.072922Z"}},"EventRecordID":2975,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NBLGGH4NNS1-Microsoft.DesktopAppInstaller","updateGuid":"3E695059-10D9-46E1-8684-4407B6814DC5","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.620285Z"}},"EventRecordID":2976,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:38.987651Z"}},"EventRecordID":2977,"Correlation":{"#attributes":{"ActivityID":"A4C17575-5E65-0001-48A8-C3A4655EDB01"}},"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":9788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9PMMSR1CGPWG-Microsoft.HEIFImageExtension","updateGuid":"AF84AB07-3C9B-4EEC-992F-D5281445DA6E","updateRevisionNumber":1,"serviceGuid":"855E8A7C-ECB4-4CA3-B045-1DFA50104289"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:40.885033Z"}},"EventRecordID":2978,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9NH2SW16MQ7F-Microsoft.WindowsAppRuntime.1.5","updateGuid":"8773522E-91D4-4492-BDE6-BBB32E34CC4E","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7045},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:47.470679Z"}},"EventRecordID":2979,"Correlation":null,"Execution":{"#attributes":{"ProcessID":788,"ThreadID":876}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"ServiceName":"Npcap Packet Driver (NPCAP)","ImagePath":"\\SystemRoot\\system32\\DRIVERS\\npcap.sys","ServiceType":"kernel mode driver","StartType":"system start","AccountName":""}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:05:51.384625Z"}},"EventRecordID":2980,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":146,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:05.805353Z"}},"EventRecordID":2981,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3640,"ThreadID":4276}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":146,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAppRuntime.1.5_5001.311.2039.0_x86__8wekyb3d8bbwe\\ActivationStore.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"User32","Guid":"{b0aa8734-56f7-41cc-b2f4-de228e98b946}","EventSourceName":"User32"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":1074},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:07.647926Z"}},"EventRecordID":2982,"Correlation":null,"Execution":{"#attributes":{"ProcessID":572,"ThreadID":1160}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"param1":"C:\\Users\\User\\Downloads\\Wireshark-4.4.2-x64.exe (WINDEV2401EVAL)","param2":"WINDEV2401EVAL","param3":"Application: Installation (Planned)","param4":"0x80040002","param5":"restart","param6":"","param7":"WINDEV2401EVAL\\User"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:07.740334Z"}},"EventRecordID":2983,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2876,"ThreadID":5048}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"9N8MHTPHNGVV-Microsoft.Windows.DevHome","updateGuid":"9FDB0C59-6D48-4E86-A387-4CC86B6FB6E4","updateRevisionNumber":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7002,"Version":0,"Level":4,"Task":1102,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:08.626566Z"}},"EventRecordID":2984,"Correlation":null,"Execution":{"#attributes":{"ProcessID":720,"ThreadID":1460}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6006},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.674863Z"}},"EventRecordID":2985,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1604,"ThreadID":10528}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"0100000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50104,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.672302Z"}},"EventRecordID":2986,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1628}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50105,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.672398Z"}},"EventRecordID":2987,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51047,"Version":0,"Level":4,"Task":4,"Opcode":63,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.679293Z"}},"EventRecordID":2988,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51057,"Version":0,"Level":4,"Task":4,"Opcode":104,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.679294Z"}},"EventRecordID":2989,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1872}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50106,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.692911Z"}},"EventRecordID":2990,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50037,"Version":0,"Level":4,"Task":4,"Opcode":69,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:09.692914Z"}},"EventRecordID":2991,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1624,"ThreadID":1780}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":{"DwordVal":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6009},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.076535Z"}},"EventRecordID":2992,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["10.00.","22621","","Multiprocessor Free","0"]},"Binary":null}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6005},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.077327Z"}},"EventRecordID":2993,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":""},"Binary":"E90701000500030015000600150043000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":109,"Version":0,"Level":4,"Task":103,"Opcode":0,"Keywords":"0x8000400000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:11.703012Z"}},"EventRecordID":2994,"Correlation":null,"Execution":{"#attributes":{"ProcessID":668,"ThreadID":672}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"ShutdownActionType":5,"ShutdownEventCode":0,"ShutdownReason":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":577,"Version":0,"Level":4,"Task":280,"Opcode":0,"Keywords":"0x8000000000000004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:12.243321Z"}},"EventRecordID":2995,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":3504}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"AdaptiveTargetState":0,"IsUnattended":false,"Status":279}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"EventLog"}},"EventID":{"#attributes":{"Qualifiers":32768},"#text":6013},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.079006Z"}},"EventRecordID":2996,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1600,"ThreadID":1716}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","","","","5","60",""]},"Binary":"31002E003100000030000000570069006E0064006F0077007300200031003000200045006E007400650072007000720069007300650020004500760061006C0075006100740069006F006E000000310030002E0030002E003200320036003200310020004200750069006C0064002000320032003600320031002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000320032003600320031002E006E0069005F00720065006C0065006100730065002E003200320030003500300036002D00310032003500300000003600350065003800320035006500360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C00650000003900000034000000380031003700360000003400300039000000570069006E0044006500760032003400300031004500760061006C0000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":13,"Version":0,"Level":4,"Task":2,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:12.331834Z"}},"EventRecordID":2997,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":3504}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"StopTime":"2025-01-03T21:06:12.331832Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":12,"Version":0,"Level":4,"Task":1,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663484Z"}},"EventRecordID":2998,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"MajorVersion":10,"MinorVersion":0,"BuildVersion":22621,"QfeVersion":3733,"ServiceVersion":0,"BootMode":0,"StartTime":"2025-01-03T21:06:15.500000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":156,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663618Z"}},"EventRecordID":2999,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Status":3221225659,"EnableDisableReason":6,"VsmPolicy":515}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":20,"Version":1,"Level":4,"Task":31,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663728Z"}},"EventRecordID":3000,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"LastShutdownGood":true,"LastBootGood":true,"LastBootId":20,"BootStatusPolicy":2}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-Hypervisor","Guid":"52FC89F8-995E-434C-A91E-199986449890"}},"EventID":59,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000400000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663739Z"}},"EventRecordID":3001,"Correlation":{"#attributes":{"ActivityID":"8540B091-2DD0-04F9-BFE7-28DBC91AF0B7"}},"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":238,"Version":1,"Level":4,"Task":101,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3002,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"EfiTimeZoneBias":2047,"EfiDaylightFlags":0,"EfiTime":"2025-01-03T13:06:15.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":124,"Version":0,"Level":2,"Task":80,"Opcode":0,"Keywords":"0x8000480000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3003,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Phase":0,"Status":3221225659}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":25,"Version":0,"Level":4,"Task":32,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663758Z"}},"EventRecordID":3004,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BootMenuPolicy":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":27,"Version":1,"Level":4,"Task":33,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663759Z"}},"EventRecordID":3005,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BootType":0,"LoadOptions":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2674688 NOVGA"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":18,"Version":0,"Level":4,"Task":57,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663798Z"}},"EventRecordID":3006,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"EntryCount":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Boot","Guid":"15CA44FF-4D7A-4BAA-BBA5-0998955E531E"}},"EventID":32,"Version":0,"Level":4,"Task":58,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.663810Z"}},"EventRecordID":3007,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BitlockerUserInputTime":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":20,"Version":0,"Level":4,"Task":6,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.665083Z"}},"EventRecordID":3008,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"UpdateReason":0,"EnabledNew":true,"CountNew":0,"CountOld":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HAL","Guid":"63D1E632-95CC-4443-9312-AF927761D52A"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:15.706421Z"}},"EventRecordID":3009,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.730715Z"}},"EventRecordID":3010,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"FileInfo","DeviceTime":"2079-02-26T14:03:00.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.730942Z"}},"EventRecordID":3011,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":3,"DeviceName":"Wof","DeviceTime":"2086-08-04T03:20:16.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:16.731299Z"}},"EventRecordID":3012,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2055-04-20T12:48:29.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Ntfs","Guid":"3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482"}},"EventID":98,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000002","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.497029Z"}},"EventRecordID":3013,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriveName":"C:","DeviceName":"\\Device\\HarddiskVolume4","CorruptionActionState":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.533145Z"}},"EventRecordID":3014,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":9,"DeviceName":"FileCrypt","DeviceTime":"1983-08-18T18:58:35.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.536607Z"}},"EventRecordID":3015,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":4,"DeviceName":"UCPD","DeviceTime":"2053-03-18T03:17:45.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"VfpExt"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7036},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.620015Z"}},"EventRecordID":3016,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","Driver load start"]},"Binary":"0000000002002C00000000007C1B0040000000000000000000000000000000000000000000000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"VfpExt"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7036},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x80000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.620015Z"}},"EventRecordID":3017,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"Data":{"#text":["","Driver load complete"]},"Binary":"0000040002003000000000007C1B004000000000000000000000000000000000000000000000000057000600"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.665964Z"}},"EventRecordID":3018,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":9,"DeviceName":"npsvctrig","DeviceTime":"1979-12-19T08:12:41.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.697954Z"}},"EventRecordID":3019,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":8}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":172,"Version":0,"Level":4,"Task":203,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.700839Z"}},"EventRecordID":3020,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"State":2,"Reason":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-PnP","Guid":"9C205A39-1250-487D-ABD7-E831C6290539"}},"EventID":219,"Version":0,"Level":3,"Task":212,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:17.704294Z"}},"EventRecordID":3021,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriverNameLength":15,"DriverName":"ROOT\\VMBus\\0000","Status":3221226341,"FailureNameLength":14,"FailureName":"\\Driver\\vmbusr","Version":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.924333Z"}},"EventRecordID":3022,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":0,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.924724Z"}},"EventRecordID":3023,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":1,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.925084Z"}},"EventRecordID":3024,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":2,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Processor-Power","Guid":"0F67E49F-FE51-4E9F-B490-6F2948CC6027"}},"EventID":55,"Version":0,"Level":4,"Task":47,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.925310Z"}},"EventRecordID":3025,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Group":0,"Number":3,"IdleStateCount":1,"IdleImplementation":1,"NominalFrequency":2495,"MaximumPerformancePercent":100,"MinimumPerformancePercent":100,"MinimumThrottlePercent":100,"PerformanceImplementation":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":521,"Version":0,"Level":4,"Task":220,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.926893Z"}},"EventRecordID":3026,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ValidBatteryCount":0,"ErrorBatteryCount":0,"AbandonedBatteryCount":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-Power","Guid":"331C3B3A-2005-44C2-AC5E-77220C37D6B4"}},"EventID":521,"Version":0,"Level":4,"Task":220,"Opcode":0,"Keywords":"0x8000000000000404","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.927322Z"}},"EventRecordID":3027,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ValidBatteryCount":1,"ErrorBatteryCount":0,"AbandonedBatteryCount":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.968277Z"}},"EventRecordID":3028,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.969491Z"}},"EventRecordID":3029,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Ntfs","Guid":"3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482"}},"EventID":98,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000002","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.978503Z"}},"EventRecordID":3030,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":52}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"DriveName":"\\\\?\\Volume{ba579dec-23d5-4cef-9451-10d971c3ff1e}","DeviceName":"\\Device\\HarddiskVolume1","CorruptionActionState":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:18.982952Z"}},"EventRecordID":3031,"Correlation":null,"Execution":{"#attributes":{"ProcessID":468,"ThreadID":472}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":15,"Version":0,"Level":4,"Task":10,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.310600Z"}},"EventRecordID":3032,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":516}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":36,"HiveName":"\\SystemRoot\\System32\\Config\\SOFTWARE","OriginalSize":109568000,"NewSize":109424640}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":24,"Version":0,"Level":4,"Task":11,"Opcode":0,"Keywords":"0x8000000000000010","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.338915Z"}},"EventRecordID":3033,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":548}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"ExitReason":0,"CurrentBias":480,"CurrentTimeZoneID":1,"TimeZoneInfoCacheUpdated":0,"FirstRefresh":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.352677Z"}},"EventRecordID":3034,"Correlation":null,"Execution":{"#attributes":{"ProcessID":440,"ThreadID":444}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":46,"HiveName":"\\Device\\HarddiskVolume2\\EFI\\Microsoft\\Boot\\BCD","KeysUpdated":68,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.617848Z"}},"EventRecordID":3035,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":524}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":35,"HiveName":"\\SystemRoot\\System32\\Config\\DEFAULT","KeysUpdated":276,"DirtyPages":47}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Wininit","Guid":"206F6DEA-D3C5-4D10-BC72-989F03C8B84B"}},"EventID":14,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.712596Z"}},"EventRecordID":3036,"Correlation":null,"Execution":{"#attributes":{"ProcessID":640,"ThreadID":644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Config":2,"IsTestConfig":0,"IsAutoEnabled":1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Wininit","Guid":"206F6DEA-D3C5-4D10-BC72-989F03C8B84B"}},"EventID":15,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.712605Z"}},"EventRecordID":3037,"Correlation":null,"Execution":{"#attributes":{"ProcessID":640,"ThreadID":644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6156,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.729645Z"}},"EventRecordID":3038,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HardwareChecks":0,"ADDomainJoin":0,"AADDomainJoin":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.733964Z"}},"EventRecordID":3039,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":512}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":36,"HiveName":"\\SystemRoot\\System32\\Config\\SECURITY","KeysUpdated":76,"DirtyPages":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.752848Z"}},"EventRecordID":3040,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"negoexts"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.756158Z"}},"EventRecordID":3041,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"kerberos"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.764627Z"}},"EventRecordID":3042,"Correlation":null,"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"msv1_0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.771357Z"}},"EventRecordID":3043,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"tspkg"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.772860Z"}},"EventRecordID":3044,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"pku2u"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.773658Z"}},"EventRecordID":3045,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"cloudap"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.793930Z"}},"EventRecordID":3046,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"wdigest"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.796492Z"}},"EventRecordID":3047,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"schannel"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.803487Z"}},"EventRecordID":3048,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"sfapm"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"LsaSrv","Guid":"199FE037-2B82-40A9-82AC-E1D46C792B99"}},"EventID":6155,"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.803912Z"}},"EventRecordID":3049,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"PackageName":"msv1_0"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16962,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.811181Z"}},"EventRecordID":3050,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_RESTRICT_REMOTE_SAM_DEFAULT_SD"},"Default SD String:":"O:SYG:SYD:(A;;RC;;;BA)"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.812265Z"}},"EventRecordID":3051,"Correlation":null,"Execution":{"#attributes":{"ProcessID":104,"ThreadID":528}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":31,"HiveName":"\\SystemRoot\\System32\\Config\\SAM","KeysUpdated":67,"DirtyPages":6}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16977,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.814160Z"}},"EventRecordID":3052,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_MINPWDLEN_SETTINGS_IN_EFFECT"},"MinimumPasswordLength":0,"RelaxMinimumPasswordLengthLimits":0,"MinimumPasswordLengthAudit":-1}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Directory-Services-SAM","Guid":"0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE"}},"EventID":16983,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.814162Z"}},"EventRecordID":3053,"Correlation":{"#attributes":{"ActivityID":"539053D8-5E23-0002-0254-9053235EDB01"}},"Execution":{"#attributes":{"ProcessID":812,"ThreadID":816}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"#attributes":{"Name":"SAMMSG_AUDIT_LEGACY_PWD_RPC_METHODS_OFF"}}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.853644Z"}},"EventRecordID":3054,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":56,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\NTUSER.DAT","KeysUpdated":86,"DirtyPages":15}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.925446Z"}},"EventRecordID":3055,"Correlation":null,"Execution":{"#attributes":{"ProcessID":936,"ThreadID":1012}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":31,"HiveName":"\\SystemRoot\\System32\\Config\\BBI","KeysUpdated":261,"DirtyPages":60}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.929613Z"}},"EventRecordID":3056,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":916}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":54,"HiveName":"\\??\\C:\\Windows\\ServiceProfiles\\LocalService\\NTUSER.DAT","KeysUpdated":54,"DirtyPages":13}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.991595Z"}},"EventRecordID":3057,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":360}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":3,"DeviceName":"bfs","DeviceTime":"2013-09-13T20:21:10.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7000},"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.993283Z"}},"EventRecordID":3058,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":1400}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"luafv","param2":"%%1275","Binary":"6C0075006100660076000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:20.996806Z"}},"EventRecordID":3059,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":5,"DeviceName":"wcifs","DeviceTime":"2086-02-07T15:15:17.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001576Z"}},"EventRecordID":3060,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":1,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001580Z"}},"EventRecordID":3061,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.001612Z"}},"EventRecordID":3062,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":6,"DeviceName":"CldFlt","DeviceTime":"2018-07-22T21:56:08.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.017906Z"}},"EventRecordID":3063,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":10,"DeviceName":"storqosflt","DeviceTime":"2065-11-24T23:15:59.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.021714Z"}},"EventRecordID":3064,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":220}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":7,"DeviceName":"bindflt","DeviceTime":"2032-10-19T17:22:30.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.069426Z"}},"EventRecordID":3065,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50103,"Version":0,"Level":4,"Task":4,"Opcode":129,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.069455Z"}},"EventRecordID":3066,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Dhcp-Client","Guid":"15A7A4F8-0072-4EAB-ABAD-F98A4D666AED"}},"EventID":50036,"Version":0,"Level":4,"Task":4,"Opcode":68,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.071720Z"}},"EventRecordID":3067,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1888}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DHCPv6-Client","Guid":"6A1F2B00-6A90-4C38-95A5-5CAB3B056778"}},"EventID":51046,"Version":0,"Level":4,"Task":4,"Opcode":62,"Keywords":"0x2000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.098069Z"}},"EventRecordID":3068,"Correlation":null,"Execution":{"#attributes":{"ProcessID":1720,"ThreadID":1508}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-19"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Hyper-V-VmSwitch","Guid":"67DC0D66-3695-47C0-9642-33F76F7BD7AD"}},"EventID":277,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000080","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.287850Z"}},"EventRecordID":3069,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":120}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"BuildNumber":22621,"BuildArch":"amd64","BuildBranch":"ni_release_svc_prod1","Debug":false,"Official":true,"Date":"1","Time":"1"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359837Z"}},"EventRecordID":3070,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:5357/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359842Z"}},"EventRecordID":3071,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/Temporary_Listen_Addresses/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359845Z"}},"EventRecordID":3072,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://*:5358/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359849Z"}},"EventRecordID":3073,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:5986/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359852Z"}},"EventRecordID":3074,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:47001/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359855Z"}},"EventRecordID":3075,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:5985/wsman/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359859Z"}},"EventRecordID":3076,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://*:2869/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359862Z"}},"EventRecordID":3077,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359866Z"}},"EventRecordID":3078,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359869Z"}},"EventRecordID":3079,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359873Z"}},"EventRecordID":3080,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359876Z"}},"EventRecordID":3081,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:10245/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359879Z"}},"EventRecordID":3082,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10243/WMPNSSv4/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359881Z"}},"EventRecordID":3083,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"https://+:3392/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359884Z"}},"EventRecordID":3084,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:3387/rdp/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359886Z"}},"EventRecordID":3085,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10246/MDEServer/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-HttpService","Guid":"DD5EF90A-6398-47A4-AD34-4DCECDEF795F"}},"EventID":112,"Version":0,"Level":4,"Task":3,"Opcode":121,"Keywords":"0x4000000000000001","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.359890Z"}},"EventRecordID":3086,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":124}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Url":"http://+:10247/apps/","ReserveStatus":0,"ProcessId":4,"ExecutablePath":"","UserSid":"S-1-5-18"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7026},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:21.571914Z"}},"EventRecordID":3087,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":788}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"\r\ndam"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1796,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:22.180226Z"}},"EventRecordID":3088,"Correlation":null,"Execution":{"#attributes":{"ProcessID":3408,"ThreadID":1788}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HResult":-2147020471}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":18,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.267544Z"}},"EventRecordID":3089,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":260}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x14","lineNumber":217,"Data":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.293761Z"}},"EventRecordID":3090,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.293840Z"}},"EventRecordID":3091,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.299555Z"}},"EventRecordID":3092,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.299892Z"}},"EventRecordID":3093,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1282,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.338441Z"}},"EventRecordID":3094,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-TPM-WMI","Guid":"7D5387B0-CBE0-11DA-A94D-0800200C9A66"}},"EventID":1025,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.352043Z"}},"EventRecordID":3095,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":null}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.353661Z"}},"EventRecordID":3096,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.353759Z"}},"EventRecordID":3097,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4040,"ThreadID":2672}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Winlogon","Guid":"DBE9B383-7CF3-4331-91CC-A3CB16A3B538"}},"EventID":7001,"Version":0,"Level":4,"Task":1101,"Opcode":0,"Keywords":"0x2000200000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:25.810932Z"}},"EventRecordID":3098,"Correlation":null,"Execution":{"#attributes":{"ProcessID":740,"ThreadID":1356}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"TSId":1,"UserSid":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.471891Z"}},"EventRecordID":3099,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.476676Z"}},"EventRecordID":3100,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.521187Z"}},"EventRecordID":3101,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.525912Z"}},"EventRecordID":3102,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":7936}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.573798Z"}},"EventRecordID":3103,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":8084}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:06:30.577053Z"}},"EventRecordID":3104,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":8084}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:29.739956Z"}},"EventRecordID":3105,"Correlation":null,"Execution":{"#attributes":{"ProcessID":5344,"ThreadID":9616}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":117,"HiveName":"\\??\\C:\\Users\\User\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat","KeysUpdated":279,"DirtyPages":24}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7045},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:07:47.870189Z"}},"EventRecordID":3106,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":868}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"ServiceName":"QcUcMElh","ImagePath":"C:\\ProgramData\\AQsYYssI\\lmIcgUEQ.exe","ServiceType":"user mode service","StartType":"auto start","AccountName":"LocalSystem"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:27.193836Z"}},"EventRecordID":3107,"Correlation":null,"Execution":{"#attributes":{"ProcessID":348,"ThreadID":572}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.WscBrokerManager","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-DistributedCOM","Guid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","EventSourceName":"DCOM"}},"EventID":{"#attributes":{"Qualifiers":0},"#text":10016},"Version":0,"Level":3,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:27.193836Z"}},"EventRecordID":3108,"Correlation":null,"Execution":{"#attributes":{"ProcessID":348,"ThreadID":572}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"application-specific","param2":"Local","param3":"Launch","param4":"Windows.SecurityCenter.SecurityAppBroker","param5":"Unavailable","param6":"NT AUTHORITY","param7":"SYSTEM","param8":"S-1-5-18","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":49152},"#text":7034},"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:08:28.295782Z"}},"EventRecordID":3109,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":3764}},"Channel":"System","Computer":"WinDev2401Eval","Security":null},"EventData":{"param1":"Microsoft Update Health Service","param2":"1","Binary":"7500680073007300760063000000"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:03.977589Z"}},"EventRecordID":3110,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9424}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:03.979705Z"}},"EventRecordID":3111,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9424}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-21-1837475949-2032650698-3025450431-1000"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Service Control Manager","Guid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","EventSourceName":"Service Control Manager"}},"EventID":{"#attributes":{"Qualifiers":16384},"#text":7040},"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8080000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:13:29.757715Z"}},"EventRecordID":3112,"Correlation":null,"Execution":{"#attributes":{"ProcessID":784,"ThreadID":2324}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"param1":"Background Intelligent Transfer Service","param2":"auto start","param3":"demand start","param4":"BITS"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.135574Z"}},"EventRecordID":3113,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.141019Z"}},"EventRecordID":3114,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.258142Z"}},"EventRecordID":3115,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.260234Z"}},"EventRecordID":3116,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.288656Z"}},"EventRecordID":3117,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:23.291483Z"}},"EventRecordID":3118,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":4384}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":44,"Version":1,"Level":4,"Task":1,"Opcode":12,"Keywords":"0x8000000000002004","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:28.201509Z"}},"EventRecordID":3119,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":4644}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":43,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000002008","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:34.640841Z"}},"EventRecordID":3120,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":6724}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":1,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:38.094294Z"}},"EventRecordID":3121,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":360}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2055-04-20T12:48:29.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-FilterManager","Guid":"F3C5E28E-63F6-49C7-A204-E48A1BC4B09D"}},"EventID":6,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:42.956721Z"}},"EventRecordID":3122,"Correlation":null,"Execution":{"#attributes":{"ProcessID":4,"ThreadID":552}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"FinalStatus":"0x0","DeviceVersionMajor":10,"DeviceVersionMinor":0,"DeviceNameLength":8,"DeviceName":"WdFilter","DeviceTime":"2072-04-25T20:11:39.000000Z"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-WindowsUpdateClient","Guid":"945A8954-C147-4ACD-923F-40C45405A658"}},"EventID":19,"Version":1,"Level":4,"Task":1,"Opcode":13,"Keywords":"0x8000000000000018","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:46.035412Z"}},"EventRecordID":3123,"Correlation":null,"Execution":{"#attributes":{"ProcessID":2788,"ThreadID":6724}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"updateTitle":"Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.24090.11) - Current Channel (Broad)","updateGuid":"21D92EC3-15E2-44F9-99CD-D46AB34D39C4","updateRevisionNumber":200,"serviceGuid":"9482F4B4-E343-43B6-B170-9A65BC822C77"}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-Kernel-General","Guid":"A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D"}},"EventID":16,"Version":0,"Level":4,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:54.418796Z"}},"EventRecordID":3124,"Correlation":null,"Execution":{"#attributes":{"ProcessID":676,"ThreadID":2188}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"HiveNameLength":85,"HiveName":"\\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat","KeysUpdated":0,"DirtyPages":0}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"Microsoft-Windows-UserModePowerService","Guid":"CE8DEE0B-D539-4000-B0F8-77BED049C590"}},"EventID":22,"Version":0,"Level":4,"Task":18,"Opcode":0,"Keywords":"0x4000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:57.609643Z"}},"EventRecordID":3125,"Correlation":null,"Execution":{"#attributes":{"ProcessID":936,"ThreadID":1060}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"Turn":5}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:59.151881Z"}},"EventRecordID":3126,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
{"Event":{"#attributes":{"xmlns":"http://schemas.microsoft.com/win/2004/08/events/event"},"System":{"Provider":{"#attributes":{"Name":"TPM","Guid":"1B6B0772-251B-4D42-917D-FACA166BC059"}},"EventID":15,"Version":0,"Level":2,"Task":0,"Opcode":0,"Keywords":"0x8000000000000000","TimeCreated":{"#attributes":{"SystemTime":"2025-01-03T21:16:59.154395Z"}},"EventRecordID":3127,"Correlation":null,"Execution":{"#attributes":{"ProcessID":7888,"ThreadID":9116}},"Channel":"System","Computer":"WinDev2401Eval","Security":{"#attributes":{"UserID":"S-1-5-18"}}},"EventData":{"driverFile":"0x2","lineNumber":369,"Data":3221225524}}}
Reference in New Issue View Git Blame Copy Permalink