<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>7</EventID><Version>3</Version><Level>4</Level><Task>7</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2020-10-28T02:39:26.388325200Z'/><EventRecordID>10685</EventRecordID><Correlation/><Execution ProcessID='1676' ThreadID='4796'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2020-10-28 02:39:26.374</Data><Data Name='ProcessGuid'>{9f32b55f-d9de-5f98-f006-000000000600}</Data><Data Name='ProcessId'>5184</Data><Data Name='Image'>C:\Windows\System32\dllhost.exe</Data><Data Name='ImageLoaded'>C:\Windows\System32\IDStore.dll</Data><Data Name='FileVersion'>10.0.17763.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Identity Store</Data><Data Name='Product'>Microsoft« Windows« Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>IdStore.dll</Data><Data Name='Hashes'>SHA1=9955A1C071C44A7CEECC0D928A9CFB7F64CC3F93,MD5=C7C45610F644906E6F7D664EF2E45B08,SHA256=4808F1101F4E42387D8DDB7A355668BAE3BF6F781C42D3BCD82E23446B1DEB3E,IMPHASH=194F3797B52231028C718B6D776C6853</Data><Data Name='Signed'>true</Data><Data Name='Signature'>Microsoft Windows</Data><Data Name='SignatureStatus'>Valid</Data></EventData></Event>
