You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1 line
1.1 KiB
1 line
1.1 KiB
<Events><Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4907</EventID><Version>0</Version><Level>0</Level><Task>13568</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2014-08-05T20:11:06.517550200Z'/><EventRecordID>1298</EventRecordID><Correlation/><Execution ProcessID='488' ThreadID='496'/><Channel>Security</Channel><Computer>WIN-9DV9ENFEJEG</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>WIN-9DV9ENFEJEG$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>File</Data><Data Name='ObjectName'>C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms</Data><Data Name='HandleId'>0x14</Data><Data Name='OldSd'></Data><Data Name='NewSd'>S:ARAI(AU;SAFA;0x1f0116;;;WD)</Data><Data Name='ProcessId'>0xa6c</Data><Data Name='ProcessName'>C:\Windows\System32\poqexec.exe</Data></EventData></Event></Events> |