ElfFilejElfChnkH p r=f?mMFK&**- io&iozZgAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannelBF;nComputerWIN-3PIMCL4OH3LAB.SecurityfLUserID !  ZrU!-IhMicrosoft-Windows-FileShareShadowCopyProvider0