﻿
TimeCreated           Id LevelDisplayName ProviderName                        Message                                  
-----------           -- ---------------- ------------                        -------                                  
17/07/2026 13:58:32 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F36E                      
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x25e8                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\systeminfo.exe       
                                                                              	Exit Status:	0x0                        
17/07/2026 13:58:31 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1b08                 
                                                                              	New Process Name:	C:\Windows\WinSxS\amd6
                                                                              4_microsoft-windows-servicingstack_31bf38
                                                                              56ad364e35_10.0.26100.8648_none_a50ef8e37
                                                                              75e8e5e\TiWorker.exe                     
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x18c               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Process Command Line:	C:\WINDOWS\winsxs\
                                                                              amd64_microsoft-windows-servicingstack_31
                                                                              bf3856ad364e35_10.0.26100.8648_none_a50ef
                                                                              8e3775e8e5e\TiWorker.exe -Embedding      
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:31 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x153c                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\servicing\TrustedInstaller.exe
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x370               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\services.exe         
                                                                              	Process Command Line:	                  
                                                                              C:\WINDOWS\servicing\TrustedInstaller.exe
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:31 4672 Information      Microsoft-Windows-Security-Auditing Special privileges assigned to new logon.
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Privileges:		                            
                                                                              SeAssignPrimaryTokenPrivilege            
                                                                              			SeTcbPrivilege                        
                                                                              			SeSecurityPrivilege                   
                                                                              			SeTakeOwnershipPrivilege              
                                                                              			SeLoadDriverPrivilege                 
                                                                              			SeBackupPrivilege                     
                                                                              			SeRestorePrivilege                    
                                                                              			SeDebugPrivilege                      
                                                                              			SeAuditPrivilege                      
                                                                              			SeSystemEnvironmentPrivilege          
                                                                              			SeImpersonatePrivilege                
                                                                              			                                      
                                                                              SeDelegateSessionUserImpersonatePrivilege
17/07/2026 13:58:31 4624 Information      Microsoft-Windows-Security-Auditing An account was successfully logged on.   
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Logon Information:                       
                                                                              	Logon Type:		5                          
                                                                              	Restricted Admin Mode:	-                
                                                                              	Remote Credential Guard:	-              
                                                                              	Virtual Account:		No                    
                                                                              	Elevated Token:		Yes                    
                                                                                                                       
                                                                              Impersonation Level:		Impersonation      
                                                                                                                       
                                                                              New Logon:                               
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                              	Linked Logon ID:		0x0                   
                                                                              	Network Account Name:	-                 
                                                                              	Network Account Domain:	-               
                                                                              	Logon GUID:		                           
                                                                              {00000000-0000-0000-0000-000000000000}   
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:		0x370                      
                                                                              	Process Name:		                         
                                                                              C:\Windows\System32\services.exe         
                                                                                                                       
                                                                              Network Information:                     
                                                                              	Workstation Name:	-                     
                                                                              	Source Network Address:	-               
                                                                              	Source Port:		-                         
                                                                                                                       
                                                                              Detailed Authentication Information:     
                                                                              	Logon Process:		Advapi                  
                                                                              	Authentication Package:	Negotiate       
                                                                              	Transited Services:	-                   
                                                                              	Package Name (NTLM only):	-             
                                                                              	Key Length:		0                          
                                                                                                                       
                                                                              This event is generated when a logon     
                                                                              session is created. It is generated on   
                                                                              the computer that was accessed.          
                                                                                                                       
                                                                              The subject fields indicate the account  
                                                                              on the local system which requested the  
                                                                              logon. This is most commonly a service   
                                                                              such as the Server service, or a local   
                                                                              process such as Winlogon.exe or          
                                                                              Services.exe.                            
                                                                                                                       
                                                                              The logon type field indicates the kind  
                                                                              of logon that occurred. The most common  
                                                                              types are 2 (interactive) and 3          
                                                                              (network).                               
                                                                                                                       
                                                                              The New Logon fields indicate the        
                                                                              account for whom the new logon was       
                                                                              created, i.e. the account that was       
                                                                              logged on.                               
                                                                                                                       
                                                                              The network fields indicate where a      
                                                                              remote logon request originated.         
                                                                              Workstation name is not always available 
                                                                              and may be left blank in some cases.     
                                                                                                                       
                                                                              The impersonation level field indicates  
                                                                              the extent to which a process in the     
                                                                              logon session can impersonate.           
                                                                                                                       
                                                                              The authentication information fields    
                                                                              provide detailed information about this  
                                                                              specific logon request.                  
                                                                              	- Logon GUID is a unique identifier     
                                                                              that can be used to correlate this event 
                                                                              with a KDC event.                        
                                                                              	- Transited services indicate which     
                                                                              intermediate services have participated  
                                                                              in this logon request.                   
                                                                              	- Package name indicates which          
                                                                              sub-protocol was used among the NTLM     
                                                                              protocols.                               
                                                                              	- Key length indicates the length of    
                                                                              the generated session key. This will be  
                                                                              0 if no session key was requested.       
17/07/2026 13:58:28 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F36E                      
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x25e8                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\systeminfo.exe       
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeFull (2)               
                                                                              	Mandatory Label:		S-1-16-12288          
                                                                              	Creator Process ID:	0x200c              
                                                                              	Creator Process Name:	C:\Windows\System3
                                                                              2\WindowsPowerShell\v1.0\powershell.exe  
                                                                              	Process Command Line:	                  
                                                                              "C:\WINDOWS\system32\systeminfo.exe"     
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:28 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F36E                      
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x200c                 
                                                                              	New Process Name:	C:\Windows\System32\Wi
                                                                              ndowsPowerShell\v1.0\powershell.exe      
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeFull (2)               
                                                                              	Mandatory Label:		S-1-16-12288          
                                                                              	Creator Process ID:	0x1794              
                                                                              	Creator Process Name:	C:\Windows\System3
                                                                              2\WindowsPowerShell\v1.0\powershell.exe  
                                                                              	Process Command Line:	"C:\WINDOWS\System
                                                                              32\WindowsPowerShell\v1.0\powershell.exe"
                                                                               -ExecutionPolicy Bypass -File           
                                                                              .\11-candidate-baseline-capture.ps1      
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1a00                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\conhost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:58:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1e90                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\cmd.exe              
                                                                              	Exit Status:	0x0                        
17/07/2026 13:58:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x2660                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\reg.exe              
                                                                              	Exit Status:	0x1                        
17/07/2026 13:58:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x2660                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\reg.exe              
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x1e90              
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\cmd.exe              
                                                                              	Process Command Line:	reg  query "HKEY_L
                                                                              OCAL_MACHINE\SYSTEM\CurrentControlSet\Con
                                                                              trol\HotPatch"                           
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1a00                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\conhost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x1e90              
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\cmd.exe              
                                                                              	Process Command Line:	                  
                                                                              \??\C:\WINDOWS\system32\conhost.exe      
                                                                              0xffffffff -ForceV1                      
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1e90                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\cmd.exe              
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x618               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Process Command Line:	                  
                                                                              "C:\WINDOWS\system32\cmd.exe" /d /c      
                                                                              C:\WINDOWS\system32\hpatchmonTask.cmd    
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:13 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1404                      
                                                                              	Process Name:	C:\Windows\System32\UIEOrc
                                                                              hestratorStub.exe                        
                                                                              	Exit Status:	0x0                        
17/07/2026 13:58:13 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1c18                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\UUS\amd64\UIEOrchestrator.exe 
                                                                              	Exit Status:	0x0                        
17/07/2026 13:58:13 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1c18                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\UUS\amd64\UIEOrchestrator.exe 
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x1404              
                                                                              	Creator Process Name:	C:\Windows\System3
                                                                              2\UIEOrchestratorStub.exe                
                                                                              	Process Command Line:	/StartServer      
                                                                              -Embedding                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:13 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1404                 
                                                                              	New Process Name:	C:\Windows\System32\UI
                                                                              EOrchestratorStub.exe                    
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x18c               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Process Command Line:	C:\WINDOWS\System3
                                                                              2\UIEOrchestratorStub.exe /StartServer   
                                                                              -Embedding                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:58:00 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F3F0                      
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0xa8c                       
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\RuntimeBroker.exe    
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:45 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x19ec                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:30 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x27f8                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\provtool.exe         
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:29 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1dbc                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:29 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1dbc                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x370               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\services.exe         
                                                                              	Process Command Line:	                  
                                                                              C:\WINDOWS\system32\svchost.exe -k       
                                                                              netsvcs -p                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:29 4672 Information      Microsoft-Windows-Security-Auditing Special privileges assigned to new logon.
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Privileges:		                            
                                                                              SeAssignPrimaryTokenPrivilege            
                                                                              			SeTcbPrivilege                        
                                                                              			SeSecurityPrivilege                   
                                                                              			SeTakeOwnershipPrivilege              
                                                                              			SeLoadDriverPrivilege                 
                                                                              			SeBackupPrivilege                     
                                                                              			SeRestorePrivilege                    
                                                                              			SeDebugPrivilege                      
                                                                              			SeAuditPrivilege                      
                                                                              			SeSystemEnvironmentPrivilege          
                                                                              			SeImpersonatePrivilege                
                                                                              			                                      
                                                                              SeDelegateSessionUserImpersonatePrivilege
17/07/2026 13:57:29 4624 Information      Microsoft-Windows-Security-Auditing An account was successfully logged on.   
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Logon Information:                       
                                                                              	Logon Type:		5                          
                                                                              	Restricted Admin Mode:	-                
                                                                              	Remote Credential Guard:	-              
                                                                              	Virtual Account:		No                    
                                                                              	Elevated Token:		Yes                    
                                                                                                                       
                                                                              Impersonation Level:		Impersonation      
                                                                                                                       
                                                                              New Logon:                               
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                              	Linked Logon ID:		0x0                   
                                                                              	Network Account Name:	-                 
                                                                              	Network Account Domain:	-               
                                                                              	Logon GUID:		                           
                                                                              {00000000-0000-0000-0000-000000000000}   
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:		0x370                      
                                                                              	Process Name:		                         
                                                                              C:\Windows\System32\services.exe         
                                                                                                                       
                                                                              Network Information:                     
                                                                              	Workstation Name:	-                     
                                                                              	Source Network Address:	-               
                                                                              	Source Port:		-                         
                                                                                                                       
                                                                              Detailed Authentication Information:     
                                                                              	Logon Process:		Advapi                  
                                                                              	Authentication Package:	Negotiate       
                                                                              	Transited Services:	-                   
                                                                              	Package Name (NTLM only):	-             
                                                                              	Key Length:		0                          
                                                                                                                       
                                                                              This event is generated when a logon     
                                                                              session is created. It is generated on   
                                                                              the computer that was accessed.          
                                                                                                                       
                                                                              The subject fields indicate the account  
                                                                              on the local system which requested the  
                                                                              logon. This is most commonly a service   
                                                                              such as the Server service, or a local   
                                                                              process such as Winlogon.exe or          
                                                                              Services.exe.                            
                                                                                                                       
                                                                              The logon type field indicates the kind  
                                                                              of logon that occurred. The most common  
                                                                              types are 2 (interactive) and 3          
                                                                              (network).                               
                                                                                                                       
                                                                              The New Logon fields indicate the        
                                                                              account for whom the new logon was       
                                                                              created, i.e. the account that was       
                                                                              logged on.                               
                                                                                                                       
                                                                              The network fields indicate where a      
                                                                              remote logon request originated.         
                                                                              Workstation name is not always available 
                                                                              and may be left blank in some cases.     
                                                                                                                       
                                                                              The impersonation level field indicates  
                                                                              the extent to which a process in the     
                                                                              logon session can impersonate.           
                                                                                                                       
                                                                              The authentication information fields    
                                                                              provide detailed information about this  
                                                                              specific logon request.                  
                                                                              	- Logon GUID is a unique identifier     
                                                                              that can be used to correlate this event 
                                                                              with a KDC event.                        
                                                                              	- Transited services indicate which     
                                                                              intermediate services have participated  
                                                                              in this logon request.                   
                                                                              	- Package name indicates which          
                                                                              sub-protocol was used among the NTLM     
                                                                              protocols.                               
                                                                              	- Key length indicates the length of    
                                                                              the generated session key. This will be  
                                                                              0 if no session key was requested.       
17/07/2026 13:57:28 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x265c                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:28 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x265c                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x370               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\services.exe         
                                                                              	Process Command Line:	                  
                                                                              C:\WINDOWS\system32\svchost.exe -k       
                                                                              netsvcs -p                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:28 4672 Information      Microsoft-Windows-Security-Auditing Special privileges assigned to new logon.
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Privileges:		                            
                                                                              SeAssignPrimaryTokenPrivilege            
                                                                              			SeTcbPrivilege                        
                                                                              			SeSecurityPrivilege                   
                                                                              			SeTakeOwnershipPrivilege              
                                                                              			SeLoadDriverPrivilege                 
                                                                              			SeBackupPrivilege                     
                                                                              			SeRestorePrivilege                    
                                                                              			SeDebugPrivilege                      
                                                                              			SeAuditPrivilege                      
                                                                              			SeSystemEnvironmentPrivilege          
                                                                              			SeImpersonatePrivilege                
                                                                              			                                      
                                                                              SeDelegateSessionUserImpersonatePrivilege
17/07/2026 13:57:28 4624 Information      Microsoft-Windows-Security-Auditing An account was successfully logged on.   
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Logon Information:                       
                                                                              	Logon Type:		5                          
                                                                              	Restricted Admin Mode:	-                
                                                                              	Remote Credential Guard:	-              
                                                                              	Virtual Account:		No                    
                                                                              	Elevated Token:		Yes                    
                                                                                                                       
                                                                              Impersonation Level:		Impersonation      
                                                                                                                       
                                                                              New Logon:                               
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                              	Linked Logon ID:		0x0                   
                                                                              	Network Account Name:	-                 
                                                                              	Network Account Domain:	-               
                                                                              	Logon GUID:		                           
                                                                              {00000000-0000-0000-0000-000000000000}   
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:		0x370                      
                                                                              	Process Name:		                         
                                                                              C:\Windows\System32\services.exe         
                                                                                                                       
                                                                              Network Information:                     
                                                                              	Workstation Name:	-                     
                                                                              	Source Network Address:	-               
                                                                              	Source Port:		-                         
                                                                                                                       
                                                                              Detailed Authentication Information:     
                                                                              	Logon Process:		Advapi                  
                                                                              	Authentication Package:	Negotiate       
                                                                              	Transited Services:	-                   
                                                                              	Package Name (NTLM only):	-             
                                                                              	Key Length:		0                          
                                                                                                                       
                                                                              This event is generated when a logon     
                                                                              session is created. It is generated on   
                                                                              the computer that was accessed.          
                                                                                                                       
                                                                              The subject fields indicate the account  
                                                                              on the local system which requested the  
                                                                              logon. This is most commonly a service   
                                                                              such as the Server service, or a local   
                                                                              process such as Winlogon.exe or          
                                                                              Services.exe.                            
                                                                                                                       
                                                                              The logon type field indicates the kind  
                                                                              of logon that occurred. The most common  
                                                                              types are 2 (interactive) and 3          
                                                                              (network).                               
                                                                                                                       
                                                                              The New Logon fields indicate the        
                                                                              account for whom the new logon was       
                                                                              created, i.e. the account that was       
                                                                              logged on.                               
                                                                                                                       
                                                                              The network fields indicate where a      
                                                                              remote logon request originated.         
                                                                              Workstation name is not always available 
                                                                              and may be left blank in some cases.     
                                                                                                                       
                                                                              The impersonation level field indicates  
                                                                              the extent to which a process in the     
                                                                              logon session can impersonate.           
                                                                                                                       
                                                                              The authentication information fields    
                                                                              provide detailed information about this  
                                                                              specific logon request.                  
                                                                              	- Logon GUID is a unique identifier     
                                                                              that can be used to correlate this event 
                                                                              with a KDC event.                        
                                                                              	- Transited services indicate which     
                                                                              intermediate services have participated  
                                                                              in this logon request.                   
                                                                              	- Package name indicates which          
                                                                              sub-protocol was used among the NTLM     
                                                                              protocols.                               
                                                                              	- Key length indicates the length of    
                                                                              the generated session key. This will be  
                                                                              0 if no session key was requested.       
17/07/2026 13:57:27 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x27a4                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\conhost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:27 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x14c4                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\Defrag.exe           
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:27 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x214c                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:27 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x214c                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x370               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\services.exe         
                                                                              	Process Command Line:	                  
                                                                              C:\WINDOWS\system32\svchost.exe -k       
                                                                              netsvcs -p                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:27 4672 Information      Microsoft-Windows-Security-Auditing Special privileges assigned to new logon.
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Privileges:		                            
                                                                              SeAssignPrimaryTokenPrivilege            
                                                                              			SeTcbPrivilege                        
                                                                              			SeSecurityPrivilege                   
                                                                              			SeTakeOwnershipPrivilege              
                                                                              			SeLoadDriverPrivilege                 
                                                                              			SeBackupPrivilege                     
                                                                              			SeRestorePrivilege                    
                                                                              			SeDebugPrivilege                      
                                                                              			SeAuditPrivilege                      
                                                                              			SeSystemEnvironmentPrivilege          
                                                                              			SeImpersonatePrivilege                
                                                                              			                                      
                                                                              SeDelegateSessionUserImpersonatePrivilege
17/07/2026 13:57:27 4624 Information      Microsoft-Windows-Security-Auditing An account was successfully logged on.   
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Logon Information:                       
                                                                              	Logon Type:		5                          
                                                                              	Restricted Admin Mode:	-                
                                                                              	Remote Credential Guard:	-              
                                                                              	Virtual Account:		No                    
                                                                              	Elevated Token:		Yes                    
                                                                                                                       
                                                                              Impersonation Level:		Impersonation      
                                                                                                                       
                                                                              New Logon:                               
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                              	Linked Logon ID:		0x0                   
                                                                              	Network Account Name:	-                 
                                                                              	Network Account Domain:	-               
                                                                              	Logon GUID:		                           
                                                                              {00000000-0000-0000-0000-000000000000}   
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:		0x370                      
                                                                              	Process Name:		                         
                                                                              C:\Windows\System32\services.exe         
                                                                                                                       
                                                                              Network Information:                     
                                                                              	Workstation Name:	-                     
                                                                              	Source Network Address:	-               
                                                                              	Source Port:		-                         
                                                                                                                       
                                                                              Detailed Authentication Information:     
                                                                              	Logon Process:		Advapi                  
                                                                              	Authentication Package:	Negotiate       
                                                                              	Transited Services:	-                   
                                                                              	Package Name (NTLM only):	-             
                                                                              	Key Length:		0                          
                                                                                                                       
                                                                              This event is generated when a logon     
                                                                              session is created. It is generated on   
                                                                              the computer that was accessed.          
                                                                                                                       
                                                                              The subject fields indicate the account  
                                                                              on the local system which requested the  
                                                                              logon. This is most commonly a service   
                                                                              such as the Server service, or a local   
                                                                              process such as Winlogon.exe or          
                                                                              Services.exe.                            
                                                                                                                       
                                                                              The logon type field indicates the kind  
                                                                              of logon that occurred. The most common  
                                                                              types are 2 (interactive) and 3          
                                                                              (network).                               
                                                                                                                       
                                                                              The New Logon fields indicate the        
                                                                              account for whom the new logon was       
                                                                              created, i.e. the account that was       
                                                                              logged on.                               
                                                                                                                       
                                                                              The network fields indicate where a      
                                                                              remote logon request originated.         
                                                                              Workstation name is not always available 
                                                                              and may be left blank in some cases.     
                                                                                                                       
                                                                              The impersonation level field indicates  
                                                                              the extent to which a process in the     
                                                                              logon session can impersonate.           
                                                                                                                       
                                                                              The authentication information fields    
                                                                              provide detailed information about this  
                                                                              specific logon request.                  
                                                                              	- Logon GUID is a unique identifier     
                                                                              that can be used to correlate this event 
                                                                              with a KDC event.                        
                                                                              	- Transited services indicate which     
                                                                              intermediate services have participated  
                                                                              in this logon request.                   
                                                                              	- Package name indicates which          
                                                                              sub-protocol was used among the NTLM     
                                                                              protocols.                               
                                                                              	- Key length indicates the length of    
                                                                              the generated session key. This will be  
                                                                              0 if no session key was requested.       
17/07/2026 13:57:21 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x334                  
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x370               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\services.exe         
                                                                              	Process Command Line:	                  
                                                                              C:\WINDOWS\system32\svchost.exe -k       
                                                                              netsvcs -p                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:21 4672 Information      Microsoft-Windows-Security-Auditing Special privileges assigned to new logon.
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Privileges:		                            
                                                                              SeAssignPrimaryTokenPrivilege            
                                                                              			SeTcbPrivilege                        
                                                                              			SeSecurityPrivilege                   
                                                                              			SeTakeOwnershipPrivilege              
                                                                              			SeLoadDriverPrivilege                 
                                                                              			SeBackupPrivilege                     
                                                                              			SeRestorePrivilege                    
                                                                              			SeDebugPrivilege                      
                                                                              			SeAuditPrivilege                      
                                                                              			SeSystemEnvironmentPrivilege          
                                                                              			SeImpersonatePrivilege                
                                                                              			                                      
                                                                              SeDelegateSessionUserImpersonatePrivilege
17/07/2026 13:57:21 4624 Information      Microsoft-Windows-Security-Auditing An account was successfully logged on.   
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Logon Information:                       
                                                                              	Logon Type:		5                          
                                                                              	Restricted Admin Mode:	-                
                                                                              	Remote Credential Guard:	-              
                                                                              	Virtual Account:		No                    
                                                                              	Elevated Token:		Yes                    
                                                                                                                       
                                                                              Impersonation Level:		Impersonation      
                                                                                                                       
                                                                              New Logon:                               
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                              	Linked Logon ID:		0x0                   
                                                                              	Network Account Name:	-                 
                                                                              	Network Account Domain:	-               
                                                                              	Logon GUID:		                           
                                                                              {00000000-0000-0000-0000-000000000000}   
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:		0x370                      
                                                                              	Process Name:		                         
                                                                              C:\Windows\System32\services.exe         
                                                                                                                       
                                                                              Network Information:                     
                                                                              	Workstation Name:	-                     
                                                                              	Source Network Address:	-               
                                                                              	Source Port:		-                         
                                                                                                                       
                                                                              Detailed Authentication Information:     
                                                                              	Logon Process:		Advapi                  
                                                                              	Authentication Package:	Negotiate       
                                                                              	Transited Services:	-                   
                                                                              	Package Name (NTLM only):	-             
                                                                              	Key Length:		0                          
                                                                                                                       
                                                                              This event is generated when a logon     
                                                                              session is created. It is generated on   
                                                                              the computer that was accessed.          
                                                                                                                       
                                                                              The subject fields indicate the account  
                                                                              on the local system which requested the  
                                                                              logon. This is most commonly a service   
                                                                              such as the Server service, or a local   
                                                                              process such as Winlogon.exe or          
                                                                              Services.exe.                            
                                                                                                                       
                                                                              The logon type field indicates the kind  
                                                                              of logon that occurred. The most common  
                                                                              types are 2 (interactive) and 3          
                                                                              (network).                               
                                                                                                                       
                                                                              The New Logon fields indicate the        
                                                                              account for whom the new logon was       
                                                                              created, i.e. the account that was       
                                                                              logged on.                               
                                                                                                                       
                                                                              The network fields indicate where a      
                                                                              remote logon request originated.         
                                                                              Workstation name is not always available 
                                                                              and may be left blank in some cases.     
                                                                                                                       
                                                                              The impersonation level field indicates  
                                                                              the extent to which a process in the     
                                                                              logon session can impersonate.           
                                                                                                                       
                                                                              The authentication information fields    
                                                                              provide detailed information about this  
                                                                              specific logon request.                  
                                                                              	- Logon GUID is a unique identifier     
                                                                              that can be used to correlate this event 
                                                                              with a KDC event.                        
                                                                              	- Transited services indicate which     
                                                                              intermediate services have participated  
                                                                              in this logon request.                   
                                                                              	- Package name indicates which          
                                                                              sub-protocol was used among the NTLM     
                                                                              protocols.                               
                                                                              	- Key length indicates the length of    
                                                                              the generated session key. This will be  
                                                                              0 if no session key was requested.       
17/07/2026 13:57:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F3F0                      
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1974                      
                                                                              	Process Name:	C:\Windows\System32\backgr
                                                                              oundTaskHost.exe                         
                                                                              	Exit Status:	0x1                        
17/07/2026 13:57:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1e6c                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x370               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\services.exe         
                                                                              	Process Command Line:	                  
                                                                              C:\WINDOWS\system32\svchost.exe -k       
                                                                              defragsvc                                
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:20 4672 Information      Microsoft-Windows-Security-Auditing Special privileges assigned to new logon.
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Privileges:		                            
                                                                              SeAssignPrimaryTokenPrivilege            
                                                                              			SeTcbPrivilege                        
                                                                              			SeSecurityPrivilege                   
                                                                              			SeTakeOwnershipPrivilege              
                                                                              			SeLoadDriverPrivilege                 
                                                                              			SeBackupPrivilege                     
                                                                              			SeRestorePrivilege                    
                                                                              			SeDebugPrivilege                      
                                                                              			SeAuditPrivilege                      
                                                                              			SeSystemEnvironmentPrivilege          
                                                                              			SeImpersonatePrivilege                
                                                                              			                                      
                                                                              SeDelegateSessionUserImpersonatePrivilege
17/07/2026 13:57:20 4624 Information      Microsoft-Windows-Security-Auditing An account was successfully logged on.   
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Logon Information:                       
                                                                              	Logon Type:		5                          
                                                                              	Restricted Admin Mode:	-                
                                                                              	Remote Credential Guard:	-              
                                                                              	Virtual Account:		No                    
                                                                              	Elevated Token:		Yes                    
                                                                                                                       
                                                                              Impersonation Level:		Impersonation      
                                                                                                                       
                                                                              New Logon:                               
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		SYSTEM                   
                                                                              	Account Domain:		NT AUTHORITY           
                                                                              	Logon ID:		0x3E7                        
                                                                              	Linked Logon ID:		0x0                   
                                                                              	Network Account Name:	-                 
                                                                              	Network Account Domain:	-               
                                                                              	Logon GUID:		                           
                                                                              {00000000-0000-0000-0000-000000000000}   
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:		0x370                      
                                                                              	Process Name:		                         
                                                                              C:\Windows\System32\services.exe         
                                                                                                                       
                                                                              Network Information:                     
                                                                              	Workstation Name:	-                     
                                                                              	Source Network Address:	-               
                                                                              	Source Port:		-                         
                                                                                                                       
                                                                              Detailed Authentication Information:     
                                                                              	Logon Process:		Advapi                  
                                                                              	Authentication Package:	Negotiate       
                                                                              	Transited Services:	-                   
                                                                              	Package Name (NTLM only):	-             
                                                                              	Key Length:		0                          
                                                                                                                       
                                                                              This event is generated when a logon     
                                                                              session is created. It is generated on   
                                                                              the computer that was accessed.          
                                                                                                                       
                                                                              The subject fields indicate the account  
                                                                              on the local system which requested the  
                                                                              logon. This is most commonly a service   
                                                                              such as the Server service, or a local   
                                                                              process such as Winlogon.exe or          
                                                                              Services.exe.                            
                                                                                                                       
                                                                              The logon type field indicates the kind  
                                                                              of logon that occurred. The most common  
                                                                              types are 2 (interactive) and 3          
                                                                              (network).                               
                                                                                                                       
                                                                              The New Logon fields indicate the        
                                                                              account for whom the new logon was       
                                                                              created, i.e. the account that was       
                                                                              logged on.                               
                                                                                                                       
                                                                              The network fields indicate where a      
                                                                              remote logon request originated.         
                                                                              Workstation name is not always available 
                                                                              and may be left blank in some cases.     
                                                                                                                       
                                                                              The impersonation level field indicates  
                                                                              the extent to which a process in the     
                                                                              logon session can impersonate.           
                                                                                                                       
                                                                              The authentication information fields    
                                                                              provide detailed information about this  
                                                                              specific logon request.                  
                                                                              	- Logon GUID is a unique identifier     
                                                                              that can be used to correlate this event 
                                                                              with a KDC event.                        
                                                                              	- Transited services indicate which     
                                                                              intermediate services have participated  
                                                                              in this logon request.                   
                                                                              	- Package name indicates which          
                                                                              sub-protocol was used among the NTLM     
                                                                              protocols.                               
                                                                              	- Key length indicates the length of    
                                                                              the generated session key. This will be  
                                                                              0 if no session key was requested.       
17/07/2026 13:57:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x27a4                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\conhost.exe          
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x14c4              
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\Defrag.exe           
                                                                              	Process Command Line:	                  
                                                                              \??\C:\WINDOWS\system32\conhost.exe      
                                                                              0xffffffff -ForceV1                      
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x14c4                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\Defrag.exe           
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x448               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Process Command Line:	                  
                                                                              "C:\WINDOWS\system32\defrag.exe" -p 448  
                                                                              -s 0000000000000390 -b -OnlyPreferred C: 
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F3F0                      
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0xa8c                  
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\RuntimeBroker.exe    
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeLimited (3)            
                                                                              	Mandatory Label:		S-1-16-8192           
                                                                              	Creator Process ID:	0x18c               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Process Command Line:	                  
                                                                              C:\Windows\System32\RuntimeBroker.exe    
                                                                              -Embedding                               
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x1ee4                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\conhost.exe          
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x2560                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\cmd.exe              
                                                                              	Exit Status:	0x0                        
17/07/2026 13:57:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x16d8                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\reg.exe              
                                                                              	Exit Status:	0x1                        
17/07/2026 13:57:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-5-21-4209295338-567392
                                                                              030-2519289182-1001                      
                                                                              	Account Name:		dfanalyst                
                                                                              	Account Domain:		disstestbedvm          
                                                                              	Logon ID:		0x1F3F0                      
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x1974                 
                                                                              	New Process Name:	C:\Windows\System32\ba
                                                                              ckgroundTaskHost.exe                     
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeLimited (3)            
                                                                              	Mandatory Label:		S-1-16-4096           
                                                                              	Creator Process ID:	0x18c               
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\svchost.exe          
                                                                              	Process Command Line:	"C:\WINDOWS\system
                                                                              32\BackgroundTaskHost.exe" -ServerName:Ba
                                                                              ckgroundTaskHost.WebAccountProvider      
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:20 4688 Information      Microsoft-Windows-Security-Auditing A new process has been created.          
                                                                                                                       
                                                                              Creator Subject:                         
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Target Subject:                          
                                                                              	Security ID:		S-1-0-0                   
                                                                              	Account Name:		-                        
                                                                              	Account Domain:		-                      
                                                                              	Logon ID:		0x0                          
                                                                                                                       
                                                                              Process Information:                     
                                                                              	New Process ID:		0x16d8                 
                                                                              	New Process Name:	                      
                                                                              C:\Windows\System32\reg.exe              
                                                                              	Token Elevation Type:	                  
                                                                              TokenElevationTypeDefault (1)            
                                                                              	Mandatory Label:		S-1-16-16384          
                                                                              	Creator Process ID:	0x2560              
                                                                              	Creator Process Name:	                  
                                                                              C:\Windows\System32\cmd.exe              
                                                                              	Process Command Line:	reg  query "HKEY_L
                                                                              OCAL_MACHINE\SYSTEM\CurrentControlSet\Con
                                                                              trol\HotPatch"                           
                                                                                                                       
                                                                              Token Elevation Type indicates the type  
                                                                              of token that was assigned to the new    
                                                                              process in accordance with User Account  
                                                                              Control policy.                          
                                                                                                                       
                                                                              Type 1 is a full token with no           
                                                                              privileges removed or groups disabled.   
                                                                              A full token is only used if User        
                                                                              Account Control is disabled or if the    
                                                                              user is the built-in Administrator       
                                                                              account or a service account.            
                                                                                                                       
                                                                              Type 2 is an elevated token with no      
                                                                              privileges removed or groups disabled.   
                                                                              An elevated token is used when User      
                                                                              Account Control is enabled and the user  
                                                                              chooses to start the program using Run   
                                                                              as administrator.  An elevated token is  
                                                                              also used when an application is         
                                                                              configured to always require             
                                                                              administrative privilege or to always    
                                                                              require maximum privilege, and the user  
                                                                              is a member of the Administrators group. 
                                                                                                                       
                                                                              Type 3 is a limited token with           
                                                                              administrative privileges removed and    
                                                                              administrative groups disabled.  The     
                                                                              limited token is used when User Account  
                                                                              Control is enabled, the application does 
                                                                              not require administrative privilege,    
                                                                              and the user does not choose to start    
                                                                              the program using Run as administrator.  
17/07/2026 13:57:20 4689 Information      Microsoft-Windows-Security-Auditing A process has exited.                    
                                                                                                                       
                                                                              Subject:                                 
                                                                              	Security ID:		S-1-5-18                  
                                                                              	Account Name:		DISSTESTBEDVM$           
                                                                              	Account Domain:		WORKGROUP              
                                                                              	Logon ID:		0x3E7                        
                                                                                                                       
                                                                              Process Information:                     
                                                                              	Process ID:	0x2604                      
                                                                              	Process Name:	                          
                                                                              C:\Windows\System32\conhost.exe          
                                                                              	Exit Status:	0x0                        


