Record 1
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Eventlog",
          "Guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"
        }
      },
      "EventID": 1102,
      "Version": 0,
      "Level": 4,
      "Task": 104,
      "Opcode": 0,
      "Keywords": "0x4020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:40:17.777875Z"
        }
      },
      "EventRecordID": 610,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 772,
          "ThreadID": 1748
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "UserData": {
      "LogFileCleared": {
        "#attributes": {
          "xmlns:auto-ns3": "http://schemas.microsoft.com/win/2004/08/events",
          "xmlns": "http://manifests.microsoft.com/win/2004/08/windows/eventlog"
        },
        "SubjectUserSid": "S-1-5-21-476853691-947408777-3389021996-1000",
        "SubjectUserName": "user",
        "SubjectDomainName": "WIN-845Q99OO4PP",
        "SubjectLogonId": "0x9e5e1"
      }
    }
  }
}
Record 2
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Security-Auditing",
          "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
        }
      },
      "EventID": 4624,
      "Version": 0,
      "Level": 0,
      "Task": 12544,
      "Opcode": 0,
      "Keywords": "0x8020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:43:33.074750Z"
        }
      },
      "EventRecordID": 611,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 484,
          "ThreadID": 2680
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "SubjectUserSid": "S-1-0-0",
      "SubjectUserName": "-",
      "SubjectDomainName": "-",
      "SubjectLogonId": "0x0",
      "TargetUserSid": "S-1-5-7",
      "TargetUserName": "ANONYMOUS LOGON",
      "TargetDomainName": "NT AUTHORITY",
      "TargetLogonId": "0x12d49a",
      "LogonType": 3,
      "LogonProcessName": "NtLmSsp",
      "AuthenticationPackageName": "NTLM",
      "WorkstationName": "f2a0mpL3eQBNuoLD",
      "LogonGuid": "00000000-0000-0000-0000-000000000000",
      "TransmittedServices": "-",
      "LmPackageName": "NTLM V1",
      "KeyLength": 0,
      "ProcessId": "0x0",
      "ProcessName": "-",
      "IpAddress": "192.168.162.128",
      "IpPort": "33871"
    }
  }
}
Record 3
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Security-Auditing",
          "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
        }
      },
      "EventID": 4634,
      "Version": 0,
      "Level": 0,
      "Task": 12545,
      "Opcode": 0,
      "Keywords": "0x8020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:43:33.684125Z"
        }
      },
      "EventRecordID": 612,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 484,
          "ThreadID": 2680
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "TargetUserSid": "S-1-5-7",
      "TargetUserName": "ANONYMOUS LOGON",
      "TargetDomainName": "NT AUTHORITY",
      "TargetLogonId": "0x12d49a",
      "LogonType": 3
    }
  }
}
Record 4
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Security-Auditing",
          "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
        }
      },
      "EventID": 4624,
      "Version": 0,
      "Level": 0,
      "Task": 12544,
      "Opcode": 0,
      "Keywords": "0x8020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:45:03.324750Z"
        }
      },
      "EventRecordID": 613,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 484,
          "ThreadID": 1660
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "SubjectUserSid": "S-1-5-18",
      "SubjectUserName": "WIN-845Q99OO4PP$",
      "SubjectDomainName": "WORKGROUP",
      "SubjectLogonId": "0x3e7",
      "TargetUserSid": "S-1-5-18",
      "TargetUserName": "SYSTEM",
      "TargetDomainName": "NT AUTHORITY",
      "TargetLogonId": "0x3e7",
      "LogonType": 5,
      "LogonProcessName": "Advapi",
      "AuthenticationPackageName": "Negotiate",
      "WorkstationName": "",
      "LogonGuid": "00000000-0000-0000-0000-000000000000",
      "TransmittedServices": "-",
      "LmPackageName": "-",
      "KeyLength": 0,
      "ProcessId": "0x1d0",
      "ProcessName": "C:\\Windows\\System32\\services.exe",
      "IpAddress": "-",
      "IpPort": "-"
    }
  }
}
Record 5
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Security-Auditing",
          "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
        }
      },
      "EventID": 4672,
      "Version": 0,
      "Level": 0,
      "Task": 12548,
      "Opcode": 0,
      "Keywords": "0x8020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:45:03.324750Z"
        }
      },
      "EventRecordID": 614,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 484,
          "ThreadID": 1660
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "SubjectUserSid": "S-1-5-18",
      "SubjectUserName": "SYSTEM",
      "SubjectDomainName": "NT AUTHORITY",
      "SubjectLogonId": "0x3e7",
      "PrivilegeList": "SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege"
    }
  }
}
Record 6
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Security-Auditing",
          "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
        }
      },
      "EventID": 4624,
      "Version": 0,
      "Level": 0,
      "Task": 12544,
      "Opcode": 0,
      "Keywords": "0x8020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:46:04.199750Z"
        }
      },
      "EventRecordID": 615,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 484,
          "ThreadID": 2680
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "SubjectUserSid": "S-1-5-18",
      "SubjectUserName": "WIN-845Q99OO4PP$",
      "SubjectDomainName": "WORKGROUP",
      "SubjectLogonId": "0x3e7",
      "TargetUserSid": "S-1-5-18",
      "TargetUserName": "SYSTEM",
      "TargetDomainName": "NT AUTHORITY",
      "TargetLogonId": "0x3e7",
      "LogonType": 5,
      "LogonProcessName": "Advapi",
      "AuthenticationPackageName": "Negotiate",
      "WorkstationName": "",
      "LogonGuid": "00000000-0000-0000-0000-000000000000",
      "TransmittedServices": "-",
      "LmPackageName": "-",
      "KeyLength": 0,
      "ProcessId": "0x1d0",
      "ProcessName": "C:\\Windows\\System32\\services.exe",
      "IpAddress": "-",
      "IpPort": "-"
    }
  }
}
Record 7
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Security-Auditing",
          "Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
        }
      },
      "EventID": 4672,
      "Version": 0,
      "Level": 0,
      "Task": 12548,
      "Opcode": 0,
      "Keywords": "0x8020000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:46:04.199750Z"
        }
      },
      "EventRecordID": 616,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 484,
          "ThreadID": 2680
        }
      },
      "Channel": "Security",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "SubjectUserSid": "S-1-5-18",
      "SubjectUserName": "SYSTEM",
      "SubjectDomainName": "NT AUTHORITY",
      "SubjectLogonId": "0x3e7",
      "PrivilegeList": "SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege"
    }
  }
}