{
"Event": {
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event",
"System": {
"Provider": {
"Name": "Microsoft-Windows-Sysmon",
"Guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}"
},
"EventID": "11",
"Version": "2",
"Level": "4",
"Task": "11",
"Opcode": "0",
"Keywords": "0x8000000000000000",
"TimeCreated": {
"SystemTime": "2017-12-21T10:53:23.092263200Z"
},
"EventRecordID": "44680233",
"Correlation": null,
"Execution": {
"ProcessID": "37328",
"ThreadID": "52352"
},
"Channel": "Microsoft-Windows-Sysmon/Operational",
"Computer": "hostname.domain.com",
"Security": {
"UserID": "S-1-5-18"
}
},
"EventData": {
"Data": [{
"text": "2017-12-21 10:53:23.092",
"Name": "UtcTime"
},
{
"text": "{684DA293-FB31-5A2C-0000-0010EB030000}",
"Name": "ProcessGuid"
},
{
"text": "4",
"Name": "ProcessId"
},
{
"text": "System",
"Name": "Image"
},
{
"text": "C:\\Shares\\LtcScriptLogs\\StartupScripts\\BGV38642514\\AdminGroup.TXT",
"Name": "TargetFilename"
},
{
"text": "2017-08-30 22:50:07.317",
"Name": "CreationUtcTime"
}]
}
}
}