Whats goin on?

• <Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__">
• <System>

  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

  <EventID>4672</EventID>

  <Version>0</Version>

  <Level>0</Level>

  <Task>12548</Task>

  <Opcode>0</Opcode>

  <Keywords>0x8020000000000000</Keywords>

  <TimeCreated SystemTime="2024-12-30T13:40:10.7510796Z" />

  <EventRecordID>8155</EventRecordID>

  <Correlation ActivityID="{5b3072ca-5a31-0000-ad73-305b315adb01}" />

  <Execution ProcessID="1208" ThreadID="1292" />

  <Channel>Security</Channel>

  <Computer>keroSher</Computer>

  <Security />

  </System>

• <EventData>

  <Data Name="SubjectUserSid">S-1-5-18</Data>

  <Data Name="SubjectUserName">SYSTEM</Data>

  <Data Name="SubjectDomainName">NT AUTHORITY</Data>

  <Data Name="SubjectLogonId">0x3e7</Data>

  <Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege</Data>

  </EventData>

  </Event>