_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:31:08.1419569Z'/><EventRecordID>750</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:31:08.1263203Z'/><EventRecordID>749</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:31:08.0954216Z'/><EventRecordID>748</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:30:55.8773592Z'/><EventRecordID>748</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259191)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='16384'>45</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:27:28.5873406Z'/><EventRecordID>756</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>Outlook loaded the following add-in(s):

Name: Microsoft Exchange Add-in
Description: Exchange support for Unified Messaging, e-mail permission rules, and calendar availability.
ProgID: UmOutlookAddin.FormRegionAddin
GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
Boot Time (Milliseconds): 47

Name: Outlook Social Connector 2016
Description: Connects to social networking sites and provides people, activity, and status information.
ProgID: OscAddin.Connect
GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\SOCIALCONNECTOR.DLL
Boot Time (Milliseconds): 47

Name: OneNote Notes about Outlook Items
Description: Adds Send to OneNote and Notes about this Item buttons to the command bar
ProgID: OneNote.OutlookAddin
GUID: {93E5752E-B889-47C5-8545-654EE2533C64}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ONBttnOL.dll
Boot Time (Milliseconds): 31

Name: Microsoft SharePoint Server Colleague Import Add-in
Description: The Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content
ProgID: ColleagueImport.ColleagueImportAddin
GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}
Load Behavior: 3
HKLM: 0
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\ColleagueImport.dll
Boot Time (Milliseconds): 0
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:27:24.2437219Z'/><EventRecordID>754</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259177)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:27:02.8966266Z'/><EventRecordID>758</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259196)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='32768'>25</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:25:18.8965586Z'/><EventRecordID>751</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win04</Computer><Security/></System><EventData><Data>Outlook is setting up a local copy of your mailbox.  It may be several minutes until all of your data is available.</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='16384'>45</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:25:18.6303574Z'/><EventRecordID>750</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win04</Computer><Security/></System><EventData><Data>Outlook loaded the following add-in(s):

Name: Microsoft VBA for Outlook Addin
Description:
ProgID: Microsoft.VbaAddinForOutlook.1
GUID: {799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}
Load Behavior: 9
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\OUTLVBA.DLL
Boot Time (Milliseconds): 31

Name: Microsoft Exchange Add-in
Description: Exchange support for Unified Messaging, e-mail permission rules, and calendar availability.
ProgID: UmOutlookAddin.FormRegionAddin
GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
Boot Time (Milliseconds): 31

Name: Outlook Social Connector 2016
Description: Connects to social networking sites and provides people, activity, and status information.
ProgID: OscAddin.Connect
GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\SOCIALCONNECTOR.DLL
Boot Time (Milliseconds): 63

Name: OneNote Notes about Outlook Items
Description: Adds Send to OneNote and Notes about this Item buttons to the command bar
ProgID: OneNote.OutlookAddin
GUID: {93E5752E-B889-47C5-8545-654EE2533C64}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ONBttnOL.dll
Boot Time (Milliseconds): 31

Name: Microsoft SharePoint Server Colleague Import Add-in
Description: The Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content
ProgID: ColleagueImport.ColleagueImportAddin
GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}
Load Behavior: 3
HKLM: 0
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\ColleagueImport.dll
Boot Time (Milliseconds): 16
</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='32768'>25</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:25:03.6410088Z'/><EventRecordID>761</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win05</Computer><Security/></System><EventData><Data>Outlook is setting up a local copy of your mailbox.  It may be several minutes until all of your data is available.</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='16384'>45</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:25:03.5112656Z'/><EventRecordID>760</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win05</Computer><Security/></System><EventData><Data>Outlook loaded the following add-in(s):

Name: Microsoft VBA for Outlook Addin
Description:
ProgID: Microsoft.VbaAddinForOutlook.1
GUID: {799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}
Load Behavior: 9
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\OUTLVBA.DLL
Boot Time (Milliseconds): 31

Name: Microsoft Exchange Add-in
Description: Exchange support for Unified Messaging, e-mail permission rules, and calendar availability.
ProgID: UmOutlookAddin.FormRegionAddin
GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
Boot Time (Milliseconds): 47

Name: Outlook Social Connector 2016
Description: Connects to social networking sites and provides people, activity, and status information.
ProgID: OscAddin.Connect
GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\SOCIALCONNECTOR.DLL
Boot Time (Milliseconds): 63

Name: OneNote Notes about Outlook Items
Description: Adds Send to OneNote and Notes about this Item buttons to the command bar
ProgID: OneNote.OutlookAddin
GUID: {93E5752E-B889-47C5-8545-654EE2533C64}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ONBttnOL.dll
Boot Time (Milliseconds): 46

Name: Microsoft SharePoint Server Colleague Import Add-in
Description: The Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content
ProgID: ColleagueImport.ColleagueImportAddin
GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}
Load Behavior: 3
HKLM: 0
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\ColleagueImport.dll
Boot Time (Milliseconds): 16
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:25:03.1615830Z'/><EventRecordID>745</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259198)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:24:42.1713763Z'/><EventRecordID>728</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t10-vdi-win06</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0xC004E003, 0, 0], [( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)( 1 0x00000000)(?)( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)(?)])(1 )(2 )(3 [0x00000000, 0, 1], [(?)( 1 0x00000000)( 6 0x00000000 30 43200)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:24:42.1400075Z'/><EventRecordID>727</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t10-vdi-win06</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0xC004E003, 0, 0], [( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)( 1 0x00000000)(?)( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)(?)])(1 )(2 )(3 [0x00000000, 0, 1], [(?)( 1 0x00000000)( 6 0x00000000 30 43200)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:24:28.1539804Z'/><EventRecordID>737</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 254830)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:24:27.9816919Z'/><EventRecordID>735</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:24:24.4235166Z'/><EventRecordID>754</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win05</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259198)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:22:55.1456939Z'/><EventRecordID>771</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259190)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='32768'>25</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:22:22.9021485Z'/><EventRecordID>742</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win06</Computer><Security/></System><EventData><Data>Outlook is setting up a local copy of your mailbox.  It may be several minutes until all of your data is available.</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='16384'>45</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:22:22.6832555Z'/><EventRecordID>741</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win06</Computer><Security/></System><EventData><Data>Outlook loaded the following add-in(s):

Name: Microsoft VBA for Outlook Addin
Description:
ProgID: Microsoft.VbaAddinForOutlook.1
GUID: {799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}
Load Behavior: 9
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\OUTLVBA.DLL
Boot Time (Milliseconds): 16

Name: Microsoft Exchange Add-in
Description: Exchange support for Unified Messaging, e-mail permission rules, and calendar availability.
ProgID: UmOutlookAddin.FormRegionAddin
GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
Boot Time (Milliseconds): 31

Name: Outlook Social Connector 2016
Description: Connects to social networking sites and provides people, activity, and status information.
ProgID: OscAddin.Connect
GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\SOCIALCONNECTOR.DLL
Boot Time (Milliseconds): 31

Name: OneNote Notes about Outlook Items
Description: Adds Send to OneNote and Notes about this Item buttons to the command bar
ProgID: OneNote.OutlookAddin
GUID: {93E5752E-B889-47C5-8545-654EE2533C64}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ONBttnOL.dll
Boot Time (Milliseconds): 31

Name: Microsoft SharePoint Server Colleague Import Add-in
Description: The Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content
ProgID: ColleagueImport.ColleagueImportAddin
GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}
Load Behavior: 3
HKLM: 0
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\ColleagueImport.dll
Boot Time (Milliseconds): 16
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:22:06.3484626Z'/><EventRecordID>739</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:22:06.3170361Z'/><EventRecordID>738</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win04</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:21:54.4553892Z'/><EventRecordID>748</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win05</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:21:54.4292173Z'/><EventRecordID>747</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win05</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:21:08.8633021Z'/><EventRecordID>739</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:21:08.8313037Z'/><EventRecordID>738</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:20:43.3708711Z'/><EventRecordID>733</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win06</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0xC004E003, 0, 0], [( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)( 1 0x00000000)(?)( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)(?)])(1 )(2 )(3 [0x00000000, 0, 1], [(?)( 1 0x00000000)( 6 0x00000000 30 43200)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:20:43.3394746Z'/><EventRecordID>732</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win06</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0xC004E003, 0, 0], [( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)( 1 0x00000000)(?)( 2 0xC004F056 0 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)(?)])(1 )(2 )(3 [0x00000000, 0, 1], [(?)( 1 0x00000000)( 6 0x00000000 30 43200)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:20:40.5736651Z'/><EventRecordID>787</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win02</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:20:36.3607749Z'/><EventRecordID>784</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win02</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:20:36.3337617Z'/><EventRecordID>783</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win02</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:19:59.7971637Z'/><EventRecordID>764</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259192)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:18:20.8072124Z'/><EventRecordID>776</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:18:20.3695104Z'/><EventRecordID>773</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:18:20.3385903Z'/><EventRecordID>772</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='32768'>25</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:16:36.0283912Z'/><EventRecordID>755</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>Outlook is setting up a local copy of your mailbox.  It may be several minutes until all of your data is available.</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='16384'>45</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:16:35.6833972Z'/><EventRecordID>753</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>Outlook loaded the following add-in(s):

Name: Microsoft VBA for Outlook Addin
Description:
ProgID: Microsoft.VbaAddinForOutlook.1
GUID: {799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}
Load Behavior: 9
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\OUTLVBA.DLL
Boot Time (Milliseconds): 16

Name: Microsoft Exchange Add-in
Description: Exchange support for Unified Messaging, e-mail permission rules, and calendar availability.
ProgID: UmOutlookAddin.FormRegionAddin
GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
Boot Time (Milliseconds): 31

Name: Outlook Social Connector 2016
Description: Connects to social networking sites and provides people, activity, and status information.
ProgID: OscAddin.Connect
GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\SOCIALCONNECTOR.DLL
Boot Time (Milliseconds): 31

Name: OneNote Notes about Outlook Items
Description: Adds Send to OneNote and Notes about this Item buttons to the command bar
ProgID: OneNote.OutlookAddin
GUID: {93E5752E-B889-47C5-8545-654EE2533C64}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ONBttnOL.dll
Boot Time (Milliseconds): 16

Name: Microsoft SharePoint Server Colleague Import Add-in
Description: The Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content
ProgID: ColleagueImport.ColleagueImportAddin
GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}
Load Behavior: 3
HKLM: 0
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\ColleagueImport.dll
Boot Time (Milliseconds): 0
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:15:12.9133916Z'/><EventRecordID>737</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:15:12.8814630Z'/><EventRecordID>736</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t5-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:13:00.2571886Z'/><EventRecordID>748</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259199)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='MsiInstaller'/><EventID Qualifiers='0'>11308</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:12:51.0097246Z'/><EventRecordID>719</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t7-vdi-win01</Computer><Security UserID='S-1-5-21-4138486928-2646479378-509589990-500'/></System><EventData><Data>Product: MobaXterm -- Error 1308. Source file not found: C:\Users\Administrator\AppData\Local\Temp\3\Temp1_MobaXterm_Installer_v25.3.zip\MobaXterm_installer.dat. Verify that the file exists and that you can access it.</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data></Data><Binary>7B41344538443045382D353935462D344331362D383231412D4334373641413439313130467D</Binary></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='MsiInstaller'/><EventID Qualifiers='0'>11308</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:12:48.8240734Z'/><EventRecordID>693</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t7-vdi-win04</Computer><Security UserID='S-1-5-21-2199248826-179912722-899821671-500'/></System><EventData><Data>Product: MobaXterm -- Error 1308. Source file not found: C:\Users\Administrator\AppData\Local\Temp\3\Temp1_MobaXterm_Installer_v25.3.zip\MobaXterm_installer.dat. Verify that the file exists and that you can access it.</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data></Data><Binary>7B41344538443045382D353935462D344331362D383231412D4334373641413439313130467D</Binary></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:11:59.3818774Z'/><EventRecordID>743</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:11:59.3504993Z'/><EventRecordID>742</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win01</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:11:56.4322492Z'/><EventRecordID>741</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win02</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 254812)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:11:55.2442929Z'/><EventRecordID>738</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win02</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:11:08.2375717Z'/><EventRecordID>736</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win03</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 254814)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:11:07.7237294Z'/><EventRecordID>733</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t1-vdi-win03</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='32768'>25</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:04:41.1721335Z'/><EventRecordID>725</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>Outlook is setting up a local copy of your mailbox.  It may be several minutes until all of your data is available.</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Outlook'/><EventID Qualifiers='16384'>45</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:04:40.5160901Z'/><EventRecordID>724</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>Outlook loaded the following add-in(s):

Name: Microsoft VBA for Outlook Addin
Description:
ProgID: Microsoft.VbaAddinForOutlook.1
GUID: {799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}
Load Behavior: 9
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\OUTLVBA.DLL
Boot Time (Milliseconds): 16

Name: Microsoft Exchange Add-in
Description: Exchange support for Unified Messaging, e-mail permission rules, and calendar availability.
ProgID: UmOutlookAddin.FormRegionAddin
GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
Boot Time (Milliseconds): 46

Name: Outlook Social Connector 2016
Description: Connects to social networking sites and provides people, activity, and status information.
ProgID: OscAddin.Connect
GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\SOCIALCONNECTOR.DLL
Boot Time (Milliseconds): 32

Name: OneNote Notes about Outlook Items
Description: Adds Send to OneNote and Notes about this Item buttons to the command bar
ProgID: OneNote.OutlookAddin
GUID: {93E5752E-B889-47C5-8545-654EE2533C64}
Load Behavior: 3
HKLM: 1
Location: C:\Program Files\Microsoft Office\Root\Office16\ONBttnOL.dll
Boot Time (Milliseconds): 15

Name: Microsoft SharePoint Server Colleague Import Add-in
Description: The Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content
ProgID: ColleagueImport.ColleagueImportAddin
GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}
Load Behavior: 3
HKLM: 0
Location: C:\Program Files\Microsoft Office\Root\Office16\ADDINS\ColleagueImport.dll
Boot Time (Milliseconds): 16
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:03:48.6560622Z'/><EventRecordID>719</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-18T14:03:48.6251502Z'/><EventRecordID>718</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>CPTC11-regionals-greatlakes-t9-vdi-win03</Computer><Security/></System><EventData><Data>0ff1ce15-a989-479d-af46-f275c6370663</Data><Data>
1: 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259200)(?)(?)(?)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:51:18.6297368Z'/><EventRecordID>384</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win04</Computer><Security/></System><EventData><Data>svchost</Data><Data>2532,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.027200 -0.003472 (9) CM -0.024450 (13) WT +J(CM:9, PgRf:67, Rd:13/7, Dy:18/96, Lg:12164/130) +M(C:32K, Fs:17, WS:64K # 64K, PF:44K # 44K, P:44K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:51:18.5988469Z'/><EventRecordID>383</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win04</Computer><Security/></System><EventData><Data>svchost</Data><Data>2532,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.078329 -0.062448 (223) CM -0.060055 (232) WT +J(CM:223, PgRf:335, Rd:0/223, Dy:14/154, Lg:56675/750) +M(C:32K, Fs:150, WS:516K # 516K, PF:696K # 696K, P:696K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:48:03.4887774Z'/><EventRecordID>313</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>svchost</Data><Data>4028,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.008756 -0.005886 (15) CM -0.005535 (17) WT +J(CM:15, PgRf:66, Rd:20/13, Dy:15/83, Lg:12164/130) +M(C:8K, Fs:12, WS:44K # 44K, PF:20K # 16K, P:20K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:48:03.4887774Z'/><EventRecordID>312</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>svchost</Data><Data>4028,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.098299 -0.059934 (223) CM -0.079407 (234) WT +J(CM:223, PgRf:335, Rd:0/223, Dy:12/118, Lg:56674/750) +M(C:32K, Fs:156, WS:532K # 532K, PF:716K # 720K, P:716K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:42:40.4084657Z'/><EventRecordID>304</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-01.allports.local</Computer><Security/></System><EventData><Data>svchost</Data><Data>2468,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.007659 -0.004021 (10) CM -0.003964 (12) WT +J(CM:10, PgRf:67, Rd:14/9, Dy:16/96, Lg:12164/130) +M(C:24K, Fs:13, WS:48K # 48K, PF:32K # 32K, P:32K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:42:40.4084657Z'/><EventRecordID>303</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-01.allports.local</Computer><Security/></System><EventData><Data>svchost</Data><Data>2468,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.095681 -0.064869 (222) CM -0.072057 (232) WT +J(CM:222, PgRf:335, Rd:0/222, Dy:15/149, Lg:56675/750) +M(C:24K, Fs:153, WS:524K # 524K, PF:712K # 712K, P:712K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:41:16.2734354Z'/><EventRecordID>379</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win01</Computer><Security/></System><EventData><Data>svchost</Data><Data>2516,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.009323 -0.006446 (14) CM -0.006497 (17) WT +J(CM:14, PgRf:67, Rd:24/11, Dy:20/86, Lg:12164/130) +M(C:32K, Fs:23, WS:88K # 88K, PF:96K # 96K, P:96K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:41:16.2577612Z'/><EventRecordID>378</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win01</Computer><Security/></System><EventData><Data>svchost</Data><Data>2516,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.076847 -0.062498 (229) CM -0.060669 (238) WT +J(CM:229, PgRf:335, Rd:0/229, Dy:10/114, Lg:56674/750) +M(C:24K, Fs:147, WS:504K # 504K, PF:640K # 644K, P:640K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:39:03.5065633Z'/><EventRecordID>380</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win05</Computer><Security/></System><EventData><Data>svchost</Data><Data>4204,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.024642 -0.005188 (13) CM -0.019436 (16) WT +J(CM:13, PgRf:66, Rd:16/12, Dy:16/88, Lg:12164/130) +M(C:24K, Fs:16, WS:60K # 60K, PF:32K # 28K, P:32K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:39:03.4752050Z'/><EventRecordID>379</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win05</Computer><Security/></System><EventData><Data>svchost</Data><Data>4204,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.088627 -0.072764 (244) CM -0.069245 (253) WT +J(CM:244, PgRf:335, Rd:0/244, Dy:8/94, Lg:56675/750) +M(C:16K, Fs:167, WS:584K # 584K, PF:688K # 688K, P:688K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:36:37.5058475Z'/><EventRecordID>377</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win02</Computer><Security/></System><EventData><Data>svchost</Data><Data>3644,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.011202 -0.007371 (13) CM -0.007107 (15) WT +J(CM:13, PgRf:67, Rd:27/12, Dy:19/83, Lg:12164/130) +M(C:24K, Fs:20, WS:76K # 76K, PF:88K # 84K, P:88K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:36:37.4900944Z'/><EventRecordID>376</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win02</Computer><Security/></System><EventData><Data>svchost</Data><Data>3644,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.082454 -0.064635 (235) CM -0.062010 (244) WT +J(CM:235, PgRf:335, Rd:0/235, Dy:10/114, Lg:56674/750) +M(C:24K, Fs:141, WS:484K # 484K, PF:628K # 632K, P:628K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:10:10.2206414Z'/><EventRecordID>311</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>APT-DC-01.allports.local</Computer><Security/></System><EventData><Data>svchost</Data><Data>3636,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log</Data><Data>
[1] 0.022947 -0.002018 (5) CM -0.020213 (9) WT +J(CM:5, PgRf:67, Rd:12/4, Dy:16/100, Lg:16214/131) +M(C:32K, Fs:25, WS:96K # 96K, PF:88K # 88K, P:88K).</Data><Data>Insert   </Data><Data>39</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='ESENT'/><EventID Qualifiers='0'>301</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T20:10:10.1892442Z'/><EventRecordID>310</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>APT-DC-01.allports.local</Computer><Security/></System><EventData><Data>svchost</Data><Data>3636,R,98</Data><Data>DS_Token_DB: </Data><Data>C:\windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log</Data><Data>
[1] 0.100104 -0.064853 (222) CM -0.079482 (232) WT +J(CM:222, PgRf:335, Rd:0/222, Dy:15/167, Lg:56674/750) +M(C:32K, Fs:163, WS:568K # 568K, PF:652K # 656K, P:652K).</Data><Data>Insert   </Data><Data>288</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T08:39:44.8364682Z'/><EventRecordID>246</EventRecordID><Correlation/><Execution ProcessID='2980' ThreadID='5036'/><Channel>Application</Channel><Computer>APT-DC-01.allports.local</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:58:40.6298596Z'/><EventRecordID>212</EventRecordID><Correlation/><Execution ProcessID='2740' ThreadID='5112'/><Channel>Application</Channel><Computer>Deckhand-01.allports.local</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4097</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:44:38.0942621Z'/><EventRecordID>291</EventRecordID><Correlation/><Execution ProcessID='2596' ThreadID='3008'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win04</Computer><Security/></System><EventData><Data>CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>3679CA35668772304D30A5FB873B0FA77BB70D54</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:44:15.6650067Z'/><EventRecordID>286</EventRecordID><Correlation/><Execution ProcessID='2596' ThreadID='3008'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win04</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4097</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:44:00.8929383Z'/><EventRecordID>291</EventRecordID><Correlation/><Execution ProcessID='2548' ThreadID='2312'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win06</Computer><Security/></System><EventData><Data>CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>3679CA35668772304D30A5FB873B0FA77BB70D54</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4097</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:42:30.0427616Z'/><EventRecordID>292</EventRecordID><Correlation/><Execution ProcessID='2524' ThreadID='2932'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win03</Computer><Security/></System><EventData><Data>CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>3679CA35668772304D30A5FB873B0FA77BB70D54</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:42:07.8477502Z'/><EventRecordID>287</EventRecordID><Correlation/><Execution ProcessID='2524' ThreadID='2932'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win03</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4097</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:41:48.3859648Z'/><EventRecordID>292</EventRecordID><Correlation/><Execution ProcessID='2540' ThreadID='3000'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win01</Computer><Security/></System><EventData><Data>CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>3679CA35668772304D30A5FB873B0FA77BB70D54</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:41:26.1569244Z'/><EventRecordID>287</EventRecordID><Correlation/><Execution ProcessID='2540' ThreadID='3000'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win01</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4097</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:39:35.7878486Z'/><EventRecordID>293</EventRecordID><Correlation/><Execution ProcessID='2556' ThreadID='2940'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win05</Computer><Security/></System><EventData><Data>CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>3679CA35668772304D30A5FB873B0FA77BB70D54</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:39:13.5154118Z'/><EventRecordID>288</EventRecordID><Correlation/><Execution ProcessID='2556' ThreadID='2940'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win05</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4097</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:37:10.6402519Z'/><EventRecordID>286</EventRecordID><Correlation/><Execution ProcessID='2588' ThreadID='2912'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win02</Computer><Security/></System><EventData><Data>CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>3679CA35668772304D30A5FB873B0FA77BB70D54</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:36:47.3825863Z'/><EventRecordID>281</EventRecordID><Correlation/><Execution ProcessID='2588' ThreadID='2912'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win02</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}' EventSourceName='Microsoft-Windows-CAPI2'/><EventID Qualifiers='0'>4109</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2025-10-16T03:05:59.7481933Z'/><EventRecordID>219</EventRecordID><Correlation/><Execution ProcessID='2868' ThreadID='2764'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US</Data><Data>4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:48:01.9159232Z'/><EventRecordID>192</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259187)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:48:01.8323906Z'/><EventRecordID>191</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:45:52.3213880Z'/><EventRecordID>174</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259190)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:45:52.2277695Z'/><EventRecordID>173</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-02.allports.local</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:44:06.2780104Z'/><EventRecordID>245</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win04</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259190)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:44:06.1529178Z'/><EventRecordID>244</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win04</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:43:27.0495257Z'/><EventRecordID>240</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win06</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259192)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:43:26.9290540Z'/><EventRecordID>239</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win06</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:42:38.4127287Z'/><EventRecordID>182</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-01.allports.local</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259188)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:42:38.3095519Z'/><EventRecordID>181</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>Deckhand-01.allports.local</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:41:56.6520862Z'/><EventRecordID>239</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win03</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259192)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:41:56.5349342Z'/><EventRecordID>238</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win03</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1003</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:41:16.1839055Z'/><EventRecordID>240</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win01</Computer><Security/></System><EventData><Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data><Data>
1: c1a197b6-ba5e-4394-b9bf-b659a6c1b873, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 180 259190)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]

</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='16384'>1066</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-10-16T02:41:16.1025839Z'/><EventRecordID>239</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>cptc11-regional-raul-t1-vdi-win01</Computer><Security/></System><EventData><Data>C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
</Data></EventData></Event>