{
"Event": {
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event",
"System": {
"Provider": {
"Name": "Microsoft-Windows-Sysmon",
"Guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}"
},
"EventID": "13",
"Version": "2",
"Level": "4",
"Task": "13",
"Opcode": "0",
"Keywords": "0x8000000000000000",
"TimeCreated": {
"SystemTime": "2017-12-21T11:01:32.482711900Z"
},
"EventRecordID": "44703841",
"Correlation": null,
"Execution": {
"ProcessID": "37328",
"ThreadID": "52352"
},
"Channel": "Microsoft-Windows-Sysmon/Operational",
"Computer": "hostname.domain.com",
"Security": {
"UserID": "S-1-5-18"
}
},
"EventData": {
"Data": [{
"text": "SetValue",
"Name": "EventType"
},
{
"text": "2017-12-21 11:01:32.482",
"Name": "UtcTime"
},
{
"text": "{684DA293-FB37-5A2C-0000-00108BA80000}",
"Name": "ProcessGuid"
},
{
"text": "600",
"Name": "ProcessId"
},
{
"text": "C:\\Windows\\system32\\services.exe",
"Name": "Image"
},
{
"text": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\copypwdsvc\\ImagePath",
"Name": "TargetObject"
},
{
"text": "C:\\Shares\\Ltc\\Ltc\\Ltc-ADC\\Copypwd\\copypwd-exe\\copypwdsvc.exe",
"Name": "Details"
}]
}
}
}