calculator.xml

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  - <System>
      <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" /> 
      <EventID>1</EventID> 
      <Version>5</Version> 
      <Level>4</Level> 
      <Task>1</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x8000000000000000</Keywords> 
      <TimeCreated SystemTime="2018-07-06T12:55:22.864710300Z" /> 
      <EventRecordID>1786</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="5940" ThreadID="3192" /> 
      <Channel>Microsoft-Windows-Sysmon/Operational</Channel> 
      <Computer>DESKTOP-LFD11QP</Computer> 
      <Security UserID="S-1-5-18" /> 
    </System>
  - <EventData>
      <Data Name="RuleName" /> 
      <Data Name="UtcTime">2018-07-06 12:55:22.803</Data> 
      <Data Name="ProcessGuid">{1C9FDC81-66BA-5B3F-0000-0010689B8B01}</Data> 
      <Data Name="ProcessId">5608</Data> 
      <Data Name="Image">C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.1301.1000_x64__8wekyb3d8bbwe\Calculator.exe</Data> 
      <Data Name="FileVersion">?</Data> 
      <Data Name="Description">?</Data> 
      <Data Name="Product">?</Data> 
      <Data Name="Company">?</Data> 
      <Data Name="CommandLine">"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.1301.1000_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca</Data> 
      <Data Name="CurrentDirectory">C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.1301.1000_x64__8wekyb3d8bbwe\</Data> 
      <Data Name="User">DESKTOP-LFD11QP\pedro</Data> 
      <Data Name="LogonGuid">{1C9FDC81-5182-5B3F-0000-002002EE5100}</Data> 
      <Data Name="LogonId">0x51ee02</Data> 
      <Data Name="TerminalSessionId">1</Data> 
      <Data Name="IntegrityLevel">AppContainer</Data> 
      <Data Name="Hashes">SHA1=F432224D1DC3DDD18A1B04902222C615194CC50F,MD5=49F97C7F1ED82E73909A269619A98CD8,SHA256=4A462353619BBD8CCD122DF18BB3DE1E22B91706E9B66815E3E108C85720EFE9,IMPHASH=259CFA5B7EA4A9E7F1C813131A278C87</Data> 
      <Data Name="ParentProcessGuid">{1C9FDC81-50C5-5B3F-0000-0010DCA20000}</Data> 
      <Data Name="ParentProcessId">868</Data> 
      <Data Name="ParentImage">C:\Windows\System32\svchost.exe</Data> 
      <Data Name="ParentCommandLine">C:\Windows\system32\svchost.exe -k DcomLaunch</Data> 
    </EventData>
  </Event>