Record 1
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Eventlog",
          "Guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"
        }
      },
      "EventID": 104,
      "Version": 0,
      "Level": 4,
      "Task": 104,
      "Opcode": 0,
      "Keywords": "0x8000000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:40:17.824750Z"
        }
      },
      "EventRecordID": 2417,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 772,
          "ThreadID": 1748
        }
      },
      "Channel": "System",
      "Computer": "WIN-845Q99OO4PP",
      "Security": {
        "#attributes": {
          "UserID": "S-1-5-21-476853691-947408777-3389021996-1000"
        }
      }
    },
    "UserData": {
      "LogFileCleared": {
        "#attributes": {
          "xmlns:auto-ns3": "http://schemas.microsoft.com/win/2004/08/events",
          "xmlns": "http://manifests.microsoft.com/win/2004/08/windows/eventlog"
        },
        "SubjectUserName": "user",
        "SubjectDomainName": "WIN-845Q99OO4PP",
        "Channel": "System",
        "BackupPath": ""
      }
    }
  }
}
Record 2
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Eventlog",
          "Guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"
        }
      },
      "EventID": 104,
      "Version": 0,
      "Level": 4,
      "Task": 104,
      "Opcode": 0,
      "Keywords": "0x8000000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:40:17.887250Z"
        }
      },
      "EventRecordID": 2418,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 772,
          "ThreadID": 1748
        }
      },
      "Channel": "System",
      "Computer": "WIN-845Q99OO4PP",
      "Security": {
        "#attributes": {
          "UserID": "S-1-5-21-476853691-947408777-3389021996-1000"
        }
      }
    },
    "UserData": {
      "LogFileCleared": {
        "#attributes": {
          "xmlns:auto-ns3": "http://schemas.microsoft.com/win/2004/08/events",
          "xmlns": "http://manifests.microsoft.com/win/2004/08/windows/eventlog"
        },
        "SubjectUserName": "user",
        "SubjectDomainName": "WIN-845Q99OO4PP",
        "Channel": "Windows PowerShell",
        "BackupPath": ""
      }
    }
  }
}
Record 3
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Eventlog",
          "Guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}"
        }
      },
      "EventID": 104,
      "Version": 0,
      "Level": 4,
      "Task": 104,
      "Opcode": 0,
      "Keywords": "0x8000000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:40:17.918500Z"
        }
      },
      "EventRecordID": 2419,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 772,
          "ThreadID": 1748
        }
      },
      "Channel": "System",
      "Computer": "WIN-845Q99OO4PP",
      "Security": {
        "#attributes": {
          "UserID": "S-1-5-21-476853691-947408777-3389021996-1000"
        }
      }
    },
    "UserData": {
      "LogFileCleared": {
        "#attributes": {
          "xmlns:auto-ns3": "http://schemas.microsoft.com/win/2004/08/events",
          "xmlns": "http://manifests.microsoft.com/win/2004/08/windows/eventlog"
        },
        "SubjectUserName": "user",
        "SubjectDomainName": "WIN-845Q99OO4PP",
        "Channel": "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin",
        "BackupPath": ""
      }
    }
  }
}
Record 4
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Service Control Manager",
          "Guid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}",
          "EventSourceName": "Service Control Manager"
        }
      },
      "EventID": {
        "#attributes": {
          "Qualifiers": 16384
        },
        "#text": 7036
      },
      "Version": 0,
      "Level": 4,
      "Task": 0,
      "Opcode": 0,
      "Keywords": "0x8080000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:45:03.324750Z"
        }
      },
      "EventRecordID": 2420,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 464,
          "ThreadID": 1164
        }
      },
      "Channel": "System",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "param1": "Windows Error Reporting Service",
      "param2": "running",
      "Binary": "5700650072005300760063002F0034000000"
    }
  }
}
Record 5
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Service Control Manager",
          "Guid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}",
          "EventSourceName": "Service Control Manager"
        }
      },
      "EventID": {
        "#attributes": {
          "Qualifiers": 49152
        },
        "#text": 7031
      },
      "Version": 0,
      "Level": 2,
      "Task": 0,
      "Opcode": 0,
      "Keywords": "0x8080000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:45:04.199750Z"
        }
      },
      "EventRecordID": 2421,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 464,
          "ThreadID": 1164
        }
      },
      "Channel": "System",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "param1": "Print Spooler",
      "param2": "1",
      "param3": "60000",
      "param4": "1",
      "param5": "Restart the service"
    }
  }
}
Record 6
{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Service Control Manager",
          "Guid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}",
          "EventSourceName": "Service Control Manager"
        }
      },
      "EventID": {
        "#attributes": {
          "Qualifiers": 16384
        },
        "#text": 7036
      },
      "Version": 0,
      "Level": 4,
      "Task": 0,
      "Opcode": 0,
      "Keywords": "0x8080000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2025-04-17T13:46:04.199750Z"
        }
      },
      "EventRecordID": 2422,
      "Correlation": null,
      "Execution": {
        "#attributes": {
          "ProcessID": 464,
          "ThreadID": 1680
        }
      },
      "Channel": "System",
      "Computer": "WIN-845Q99OO4PP",
      "Security": null
    },
    "EventData": {
      "param1": "Print Spooler",
      "param2": "running",
      "Binary": "530070006F006F006C00650072002F0034000000"
    }
  }
}