<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2019-03-18T16:57:38.011477000Z'/><EventRecordID>3</EventRecordID><Correlation/><Execution ProcessID='4860' ThreadID='4516'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>vagrant-2012-r2</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'></Data><Data Name='UtcTime'>2019-03-18 16:57:37.949</Data><Data Name='ProcessGuid'>{42f11c3b-ce01-5c8f-0000-0010c73e2a00}</Data><Data Name='ProcessId'>4860</Data><Data Name='Image'>C:\Windows\Sysmon.exe</Data><Data Name='FileVersion'>9.01</Data><Data Name='Description'>System activity monitor</Data><Data Name='Product'>Sysinternals Sysmon</Data><Data Name='Company'>Sysinternals - www.sysinternals.com</Data><Data Name='CommandLine'>C:\Windows\Sysmon.exe</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{42f11c3b-6e1a-5c8c-0000-0020e7030000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=AC93C3B38E57A2715572933DBCB2A1C2892DBC5E</Data><Data Name='ParentProcessGuid'>{42f11c3b-6e1a-5c8c-0000-0010f14d0000}</Data><Data Name='ParentProcessId'>488</Data><Data Name='ParentImage'>C:\Windows\System32\services.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\services.exe</Data></EventData></Event>
