{
    "Event": {
        "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event",
        "System": {
            "Provider": {
                "Name": "Microsoft-Windows-Security-Auditing",
                "Guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"
            },
            "EventID": "4738",
            "Version": "0",
            "Level": "0",
            "Task": "13824",
            "Opcode": "0",
            "Keywords": "0x8020000000000000",
            "TimeCreated": {
                "SystemTime": "2015-05-20T11:32:39.516425400Z"
            },
            "EventRecordID": "384",
            "Correlation": null,
            "Execution": {
                "ProcessID": "540",
                "ThreadID": "1076"
            },
            "Channel": "Security",
            "Computer": "win8apt",
            "Security": null
        },
        "EventData": {
            "Data": [{
                "text": "-",
                "Name": "Dummy"
            },
            {
                "text": "user",
                "Name": "TargetUserName"
            },
            {
                "text": "win8apt",
                "Name": "TargetDomainName"
            },
            {
                "text": "S-1-5-21-1696497901-2464395969-3216509008-1003",
                "Name": "TargetSid"
            },
            {
                "text": "S-1-5-21-1696497901-2464395969-3216509008-1002",
                "Name": "SubjectUserSid"
            },
            {
                "text": "ivanov",
                "Name": "SubjectUserName"
            },
            {
                "text": "win8apt",
                "Name": "SubjectDomainName"
            },
            {
                "text": "0x2ef059",
                "Name": "SubjectLogonId"
            },
            {
                "text": "-",
                "Name": "PrivilegeList"
            },
            {
                "text": "user",
                "Name": "SamAccountName"
            },
            {
                "text": "user",
                "Name": "DisplayName"
            },
            {
                "text": "-",
                "Name": "UserPrincipalName"
            },
            {
                "text": "%%1793",
                "Name": "HomeDirectory"
            },
            {
                "text": "%%1793",
                "Name": "HomePath"
            },
            {
                "text": "%%1793",
                "Name": "ScriptPath"
            },
            {
                "text": "%%1793",
                "Name": "ProfilePath"
            },
            {
                "text": "%%1793",
                "Name": "UserWorkstations"
            },
            {
                "text": "5/20/2015 4:32:39 AM",
                "Name": "PasswordLastSet"
            },
            {
                "text": "%%1794",
                "Name": "AccountExpires"
            },
            {
                "text": "513",
                "Name": "PrimaryGroupId"
            },
            {
                "text": "-",
                "Name": "AllowedToDelegateTo"
            },
            {
                "text": "0x15",
                "Name": "OldUacValue"
            },
            {
                "text": "0x10",
                "Name": "NewUacValue"
            },
            {
                "text": "\n\t\t%%2048\n\t\t%%2089",
                "Name": "UserAccountControl"
            },
            {
                "text": "-",
                "Name": "UserParameters"
            },
            {
                "text": "-",
                "Name": "SidHistory"
            },
            {
                "text": "%%1797",
                "Name": "LogonHours"
            }]
        }
    }
}