Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:12:28 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:42:28.314268000Z" />
    <EventRecordID>862</EventRecordID>
    <Correlation />
    <Execution ProcessID="8880" ThreadID="7404" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">85</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 8:08:56 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:56.278978800Z" />
    <EventRecordID>861</EventRecordID>
    <Correlation />
    <Execution ProcessID="620" ThreadID="1932" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">BITS</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:08:16 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:16.236265300Z" />
    <EventRecordID>860</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:08:16 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:16.236262600Z" />
    <EventRecordID>859</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:08:11 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:11.526948400Z" />
    <EventRecordID>858</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">105</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:08:09 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:09.838638100Z" />
    <EventRecordID>857</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">147</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:08:07 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:07.161369200Z" />
    <EventRecordID>856</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE</Data>
    <Data Name="updateGuid">{4B71C82D-06A6-405A-ADCB-809A831F2953}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:08:07 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:07.161366600Z" />
    <EventRecordID>855</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE</Data>
    <Data Name="updateGuid">{4B71C82D-06A6-405A-ADCB-809A831F2953}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:08:03 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:03.044458300Z" />
    <EventRecordID>854</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">101</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:08:00 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Office.OneNote_16001.11001.20079.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:38:00.806415000Z" />
    <EventRecordID>853</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">143</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Office.OneNote_16001.11001.20079.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:24 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9PMMSR1CGPWG-Microsoft.HEIFImageExtension
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:24.512394100Z" />
    <EventRecordID>852</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PMMSR1CGPWG-Microsoft.HEIFImageExtension</Data>
    <Data Name="updateGuid">{04420D3B-D33D-461E-8808-1E910DD3853A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:24 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9PMMSR1CGPWG-Microsoft.HEIFImageExtension
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:24.512391700Z" />
    <EventRecordID>851</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PMMSR1CGPWG-Microsoft.HEIFImageExtension</Data>
    <Data Name="updateGuid">{04420D3B-D33D-461E-8808-1E910DD3853A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:07:20 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:20.218364900Z" />
    <EventRecordID>850</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">105</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:07:18 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.HEIFImageExtension_1.0.12812.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:18.372472200Z" />
    <EventRecordID>849</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">139</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.HEIFImageExtension_1.0.12812.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:09 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:09.796001100Z" />
    <EventRecordID>848</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PMMSR1CGPWG-Microsoft.HEIFImageExtension</Data>
    <Data Name="updateGuid">{04420D3B-D33D-461E-8808-1E910DD3853A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:09 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:09.795999500Z" />
    <EventRecordID>847</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:09 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:09.795996700Z" />
    <EventRecordID>846</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:04.963604400Z" />
    <EventRecordID>845</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE</Data>
    <Data Name="updateGuid">{4B71C82D-06A6-405A-ADCB-809A831F2953}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:04.963603300Z" />
    <EventRecordID>844</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:04.963602300Z" />
    <EventRecordID>843</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:04.963600000Z" />
    <EventRecordID>842</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE</Data>
    <Data Name="updateGuid">{4B71C82D-06A6-405A-ADCB-809A831F2953}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:04 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH5FV99-Microsoft.MSPaint
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:04.961079000Z" />
    <EventRecordID>841</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5FV99-Microsoft.MSPaint</Data>
    <Data Name="updateGuid">{A8406E48-63CA-4B02-B5F1-3DB707E5399D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:07:04 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH5FV99-Microsoft.MSPaint
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:37:04.961077700Z" />
    <EventRecordID>840</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5FV99-Microsoft.MSPaint</Data>
    <Data Name="updateGuid">{A8406E48-63CA-4B02-B5F1-3DB707E5399D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:06:59 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:59.983124300Z" />
    <EventRecordID>839</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">94</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:06:57 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MSPaint_5.1809.1017.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:57.442860700Z" />
    <EventRecordID>838</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">130</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MSPaint_5.1809.1017.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:06:34 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.RemoteDesktop_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:34.191633200Z" />
    <EventRecordID>837</EventRecordID>
    <Correlation />
    <Execution ProcessID="8920" ThreadID="8432" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">100</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.RemoteDesktop_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:16 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:16.588633200Z" />
    <EventRecordID>836</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVJL-MICROSOFT.OFFICE.ONENOTE</Data>
    <Data Name="updateGuid">{4B71C82D-06A6-405A-ADCB-809A831F2953}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:10.141997600Z" />
    <EventRecordID>835</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:10.141996800Z" />
    <EventRecordID>834</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:10.141994700Z" />
    <EventRecordID>833</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5FV99-Microsoft.MSPaint</Data>
    <Data Name="updateGuid">{A8406E48-63CA-4B02-B5F1-3DB707E5399D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:05.141838400Z" />
    <EventRecordID>832</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:05.141837600Z" />
    <EventRecordID>831</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:05.141836400Z" />
    <EventRecordID>830</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5FV99-Microsoft.MSPaint</Data>
    <Data Name="updateGuid">{A8406E48-63CA-4B02-B5F1-3DB707E5399D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:06:05 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:36:05.141833400Z" />
    <EventRecordID>829</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR</Data>
    <Data Name="updateGuid">{6E659657-1C47-4291-B1AA-1B272A203C09}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:59 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:59.192971100Z" />
    <EventRecordID>828</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR</Data>
    <Data Name="updateGuid">{6E659657-1C47-4291-B1AA-1B272A203C09}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:59.192966200Z" />
    <EventRecordID>827</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5FV99-Microsoft.MSPaint</Data>
    <Data Name="updateGuid">{A8406E48-63CA-4B02-B5F1-3DB707E5399D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:58 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:58.200759900Z" />
    <EventRecordID>826</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">104</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:57 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:57.202550200Z" />
    <EventRecordID>825</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:57 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:57.202549200Z" />
    <EventRecordID>824</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:57 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:57.202546700Z" />
    <EventRecordID>823</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR</Data>
    <Data Name="updateGuid">{6E659657-1C47-4291-B1AA-1B272A203C09}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:55 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCalculator_10.1809.2731.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:55.010350400Z" />
    <EventRecordID>822</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">141</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCalculator_10.1809.2731.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:51 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:51.673167000Z" />
    <EventRecordID>821</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD29V9-MICROSOFT.MICROSOFTOFFICEHUB</Data>
    <Data Name="updateGuid">{9B0928D2-6D9E-4A8F-8C86-E3789F607BB3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:51 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9MZ95KL8MR0L-Microsoft.ScreenSketch
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:51.666357800Z" />
    <EventRecordID>820</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ95KL8MR0L-Microsoft.ScreenSketch</Data>
    <Data Name="updateGuid">{48B2B43D-45E0-454B-A8BD-2EA52A4F6CBD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:51 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:51.666348100Z" />
    <EventRecordID>819</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:44.328769600Z" />
    <EventRecordID>818</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR</Data>
    <Data Name="updateGuid">{6E659657-1C47-4291-B1AA-1B272A203C09}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:44.328768700Z" />
    <EventRecordID>817</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:44.328767800Z" />
    <EventRecordID>816</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR</Data>
    <Data Name="updateGuid">{6E659657-1C47-4291-B1AA-1B272A203C09}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:44 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9MZ95KL8MR0L-Microsoft.ScreenSketch
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:44.328766500Z" />
    <EventRecordID>815</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ95KL8MR0L-Microsoft.ScreenSketch</Data>
    <Data Name="updateGuid">{48B2B43D-45E0-454B-A8BD-2EA52A4F6CBD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:44 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH10PG8-MICROSOFT.PEOPLE
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:44.328764600Z" />
    <EventRecordID>814</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:43 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:43.202321900Z" />
    <EventRecordID>813</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">99</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:42 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH10PG8-MICROSOFT.PEOPLE
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:42.256702800Z" />
    <EventRecordID>812</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:39 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:39.212293800Z" />
    <EventRecordID>811</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">93</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:38 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ScreenSketch_10.1809.2964.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:38.911455000Z" />
    <EventRecordID>810</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">136</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ScreenSketch_10.1809.2964.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:37 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:37.407101000Z" />
    <EventRecordID>809</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:37 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:37.407099600Z" />
    <EventRecordID>808</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:32 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:32.922865100Z" />
    <EventRecordID>807</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR</Data>
    <Data Name="updateGuid">{6E659657-1C47-4291-B1AA-1B272A203C09}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:32 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:32.922862300Z" />
    <EventRecordID>806</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:30 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:30.898237700Z" />
    <EventRecordID>805</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:30 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:30.898236100Z" />
    <EventRecordID>804</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:30 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:30.898234000Z" />
    <EventRecordID>803</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ95KL8MR0L-Microsoft.ScreenSketch</Data>
    <Data Name="updateGuid">{48B2B43D-45E0-454B-A8BD-2EA52A4F6CBD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:26 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.People_10.1808.2473.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:26.007481100Z" />
    <EventRecordID>802</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">130</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.People_10.1808.2473.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:24 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:24.812873500Z" />
    <EventRecordID>801</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:24 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:24.812872200Z" />
    <EventRecordID>800</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:24 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:24.812871200Z" />
    <EventRecordID>799</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ95KL8MR0L-Microsoft.ScreenSketch</Data>
    <Data Name="updateGuid">{48B2B43D-45E0-454B-A8BD-2EA52A4F6CBD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:24 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:24.812868500Z" />
    <EventRecordID>798</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:22 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:22.361418800Z" />
    <EventRecordID>797</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:22 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:22.361417400Z" />
    <EventRecordID>796</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:05:18 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:18.433899900Z" />
    <EventRecordID>795</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">107</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:17 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:17.300438100Z" />
    <EventRecordID>794</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 8:05:17 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:17.300437000Z" />
    <EventRecordID>793</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Power-Troubleshooter
Date:          15/11/2018 8:05:13 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
The system has returned from a low power state.

Sleep Time: ?2018?-?11?-?15T09:19:56.066604000Z
Wake Time: ?2018?-?11?-?15T09:35:06.170860400Z

Wake Source: Device -USB Root Hub
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{CDC05E28-C449-49C6-B9D2-88CF761644DF}" />
    <EventID>1</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:35:13.259880100Z" />
    <EventRecordID>792</EventRecordID>
    <Correlation ActivityID="{06340434-5C91-455C-A0C0-2E5C7363761D}" />
    <Execution ProcessID="2760" ThreadID="3484" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="SleepTime">2018-11-15T09:19:56.066604000Z</Data>
    <Data Name="WakeTime">2018-11-15T09:35:06.170860400Z</Data>
    <Data Name="SleepDuration">2172</Data>
    <Data Name="WakeDuration">8680</Data>
    <Data Name="DriverInitDuration">7074</Data>
    <Data Name="BiosInitDuration">617</Data>
    <Data Name="HiberWriteDuration">3021</Data>
    <Data Name="HiberReadDuration">0</Data>
    <Data Name="HiberPagesWritten">105988</Data>
    <Data Name="Attributes">1912624129</Data>
    <Data Name="TargetState">4</Data>
    <Data Name="EffectiveState">5</Data>
    <Data Name="WakeSourceType">5</Data>
    <Data Name="WakeSourceTextLength">12</Data>
    <Data Name="WakeSourceText">USB Root Hub</Data>
    <Data Name="WakeTimerOwnerLength">0</Data>
    <Data Name="WakeTimerContextLength">0</Data>
    <Data Name="NoMultiStageResumeReason">0</Data>
    <Data Name="WakeTimerOwner">
    </Data>
    <Data Name="WakeTimerContext">
    </Data>
  </EventData>
</Event>

Log Name:      System
Source:        e1cexpress
Date:          15/11/2018 8:04:57 PM
Event ID:      27
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 27 from source e1cexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

Intel(R) 82579LM Gigabit Network Connection

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="e1cexpress" />
    <EventID Qualifiers="40964">27</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:34:57.925825500Z" />
    <EventRecordID>791</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>Intel(R) 82579LM Gigabit Network Connection</Data>
    <Binary>0000040002003000000000001B0004A00000000000000000000000000000000000000000000000001B0004A0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 8:04:57 PM
Event ID:      1
Task Category: (5)
Level:         Information
Keywords:      Time
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 1 from source Microsoft-Windows-Kernel-General cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

15/11/2018 9:34:57 AM
15/11/2018 9:19:59 AM
2
4

the message resource is present but the message is not found in the string/message table

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>1</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>5</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:34:57.500363000Z" />
    <EventRecordID>790</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="6972" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="NewTime">2018-11-15T09:34:57.500000000Z</Data>
    <Data Name="OldTime">2018-11-15T09:19:59.999934600Z</Data>
    <Data Name="Reason">2</Data>
    <Data Name="ProcessName">
    </Data>
    <Data Name="ProcessID">4</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          15/11/2018 7:49:59 PM
Event ID:      107
Task Category: (102)
Level:         Information
Keywords:      (1024),(64),(4)
User:          N/A
Computer:      user-PC
Description:
The system has resumed from sleep.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>107</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>102</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000444</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:59.999971200Z" />
    <EventRecordID>789</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="6972" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetState">4</Data>
    <Data Name="EffectiveState">5</Data>
    <Data Name="WakeFromState">4</Data>
    <Data Name="ProgrammedWakeTimeAc">2018-11-15T19:51:46.946353600Z</Data>
    <Data Name="ProgrammedWakeTimeDc">1601-01-01T00:00:00.000000000Z</Data>
    <Data Name="WakeRequesterTypeAc">2</Data>
    <Data Name="WakeRequesterTypeDc">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          15/11/2018 7:49:57 PM
Event ID:      42
Task Category: (64)
Level:         Information
Keywords:      (1024),(4)
User:          N/A
Computer:      user-PC
Description:
The system is entering sleep.

Sleep Reason: System Idle
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>42</EventID>
    <Version>3</Version>
    <Level>4</Level>
    <Task>64</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000404</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:57.861376900Z" />
    <EventRecordID>788</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="6972" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetState">4</Data>
    <Data Name="EffectiveState">5</Data>
    <Data Name="Reason">7</Data>
    <Data Name="Flags">0</Data>
    <Data Name="TransitionsToOn">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:54 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:54.905915500Z" />
    <EventRecordID>787</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ95KL8MR0L-Microsoft.ScreenSketch</Data>
    <Data Name="updateGuid">{48B2B43D-45E0-454B-A8BD-2EA52A4F6CBD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:54 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:54.905914100Z" />
    <EventRecordID>786</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:54 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:54.905913000Z" />
    <EventRecordID>785</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:54 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:54.905910200Z" />
    <EventRecordID>784</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:49:52 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftStickyNotes_3.0.119.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:52.541990900Z" />
    <EventRecordID>783</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">139</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftStickyNotes_3.0.119.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:49.577134700Z" />
    <EventRecordID>782</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:49.577133800Z" />
    <EventRecordID>781</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:49.577132900Z" />
    <EventRecordID>780</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:49 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:49.577129500Z" />
    <EventRecordID>779</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA</Data>
    <Data Name="updateGuid">{7ABC6239-E4FA-4AEC-A7CB-29C73564645E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:44 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:44.891993100Z" />
    <EventRecordID>778</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA</Data>
    <Data Name="updateGuid">{7ABC6239-E4FA-4AEC-A7CB-29C73564645E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:44.891985100Z" />
    <EventRecordID>777</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH10PG8-MICROSOFT.PEOPLE</Data>
    <Data Name="updateGuid">{96338319-E091-4262-BF12-DED0AEF70536}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:42 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:42.515310900Z" />
    <EventRecordID>776</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:42 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:42.515308100Z" />
    <EventRecordID>775</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:49:41 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCamera_2018.824.60.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:41.466452000Z" />
    <EventRecordID>774</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">136</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCamera_2018.824.60.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:38.337244700Z" />
    <EventRecordID>773</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA</Data>
    <Data Name="updateGuid">{7ABC6239-E4FA-4AEC-A7CB-29C73564645E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:38.337242400Z" />
    <EventRecordID>772</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:38.337240300Z" />
    <EventRecordID>771</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:38.337237000Z" />
    <EventRecordID>770</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA</Data>
    <Data Name="updateGuid">{7ABC6239-E4FA-4AEC-A7CB-29C73564645E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:37 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH537C2-Microsoft.XboxGameOverlay
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:37.553579300Z" />
    <EventRecordID>769</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH537C2-Microsoft.XboxGameOverlay</Data>
    <Data Name="updateGuid">{5EA49708-A290-4DA0-9A04-56FFA6000E71}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:37 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH537C2-Microsoft.XboxGameOverlay
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:37.553577900Z" />
    <EventRecordID>768</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH537C2-Microsoft.XboxGameOverlay</Data>
    <Data Name="updateGuid">{5EA49708-A290-4DA0-9A04-56FFA6000E71}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:49:33 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:33.987612800Z" />
    <EventRecordID>767</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">102</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:49:32 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameOverlay_1.35.8001.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:32.018007800Z" />
    <EventRecordID>766</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">136</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameOverlay_1.35.8001.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:27 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:27.481674800Z" />
    <EventRecordID>765</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBBG-MICROSOFT.WINDOWSCAMERA</Data>
    <Data Name="updateGuid">{7ABC6239-E4FA-4AEC-A7CB-29C73564645E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:22.484169900Z" />
    <EventRecordID>764</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:22.484167300Z" />
    <EventRecordID>763</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:18.386706600Z" />
    <EventRecordID>762</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH537C2-Microsoft.XboxGameOverlay</Data>
    <Data Name="updateGuid">{5EA49708-A290-4DA0-9A04-56FFA6000E71}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:18.386705000Z" />
    <EventRecordID>761</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:18.386703800Z" />
    <EventRecordID>760</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:18.386701600Z" />
    <EventRecordID>759</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH537C2-Microsoft.XboxGameOverlay</Data>
    <Data Name="updateGuid">{5EA49708-A290-4DA0-9A04-56FFA6000E71}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:18 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NMPJ99VJBWV-Microsoft.YourPhone
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:18.380228000Z" />
    <EventRecordID>758</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NMPJ99VJBWV-Microsoft.YourPhone</Data>
    <Data Name="updateGuid">{782780BA-0FA8-4F84-81EC-A3E2D114C41E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:18 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NMPJ99VJBWV-Microsoft.YourPhone
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:18.380226600Z" />
    <EventRecordID>757</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NMPJ99VJBWV-Microsoft.YourPhone</Data>
    <Data Name="updateGuid">{782780BA-0FA8-4F84-81EC-A3E2D114C41E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:49:14 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:14.453138000Z" />
    <EventRecordID>756</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">96</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:49:12 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.YourPhone_1.0.12964.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:12.094276000Z" />
    <EventRecordID>755</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">130</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.YourPhone_1.0.12964.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:09 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:09.527578100Z" />
    <EventRecordID>754</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH537C2-Microsoft.XboxGameOverlay</Data>
    <Data Name="updateGuid">{5EA49708-A290-4DA0-9A04-56FFA6000E71}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:03.225554300Z" />
    <EventRecordID>753</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NMPJ99VJBWV-Microsoft.YourPhone</Data>
    <Data Name="updateGuid">{782780BA-0FA8-4F84-81EC-A3E2D114C41E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:03.225553200Z" />
    <EventRecordID>752</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:49:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:19:03.225550500Z" />
    <EventRecordID>751</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:58 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:58.482241100Z" />
    <EventRecordID>750</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NMPJ99VJBWV-Microsoft.YourPhone</Data>
    <Data Name="updateGuid">{782780BA-0FA8-4F84-81EC-A3E2D114C41E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:58 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:58.482239900Z" />
    <EventRecordID>749</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:58 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:58.482238700Z" />
    <EventRecordID>748</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:58 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9N5TDP8VCMHS-Microsoft.WebMediaExtensions
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:58.482235000Z" />
    <EventRecordID>747</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:54 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:54.689055100Z" />
    <EventRecordID>746</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">105</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:53 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9N5TDP8VCMHS-Microsoft.WebMediaExtensions
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:53.734322300Z" />
    <EventRecordID>745</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:53 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:53.734314200Z" />
    <EventRecordID>744</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes</Data>
    <Data Name="updateGuid">{D5240D9C-E6D8-48CC-86A6-F4EB47EF7BCB}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:50 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:50.824088100Z" />
    <EventRecordID>743</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NMPJ99VJBWV-Microsoft.YourPhone</Data>
    <Data Name="updateGuid">{782780BA-0FA8-4F84-81EC-A3E2D114C41E}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:50 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:50.824083000Z" />
    <EventRecordID>742</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:48 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WebMediaExtensions_1.0.12902.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:48.450324400Z" />
    <EventRecordID>741</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">139</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WebMediaExtensions_1.0.12902.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:44.766437000Z" />
    <EventRecordID>740</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:44.766435800Z" />
    <EventRecordID>739</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:44.766435000Z" />
    <EventRecordID>738</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:44.766433900Z" />
    <EventRecordID>737</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop</Data>
    <Data Name="updateGuid">{FA7BF998-D5A9-4440-B7B1-20E16F3CD7B8}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:44.766431700Z" />
    <EventRecordID>736</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop</Data>
    <Data Name="updateGuid">{FA7BF998-D5A9-4440-B7B1-20E16F3CD7B8}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:42 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:42.365010900Z" />
    <EventRecordID>735</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER</Data>
    <Data Name="updateGuid">{AC2A7AB5-4029-4352-B278-86467EA8C573}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:42 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:42.365008700Z" />
    <EventRecordID>734</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:42 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:42.365005700Z" />
    <EventRecordID>733</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:37 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:37.726345800Z" />
    <EventRecordID>732</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:37 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:37.726345000Z" />
    <EventRecordID>731</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:37 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:37.726342100Z" />
    <EventRecordID>730</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER</Data>
    <Data Name="updateGuid">{AC2A7AB5-4029-4352-B278-86467EA8C573}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:37 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:37.598844600Z" />
    <EventRecordID>729</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">107</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:36 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:36.882288100Z" />
    <EventRecordID>728</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:36 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:36.882286300Z" />
    <EventRecordID>727</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:34 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsSoundRecorder_10.1809.2731.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:34.916686600Z" />
    <EventRecordID>726</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">144</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsSoundRecorder_10.1809.2731.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:33.862283300Z" />
    <EventRecordID>725</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N5TDP8VCMHS-Microsoft.WebMediaExtensions</Data>
    <Data Name="updateGuid">{98E98EC1-0304-4157-8883-91604943CDE2}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:33.862280800Z" />
    <EventRecordID>724</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1</Data>
    <Data Name="updateGuid">{C31E5AC8-D4C1-41BB-A2CE-DB1976144A14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:29 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRD1HKW-Microsoft.XboxIdentityProvider
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:29.083943100Z" />
    <EventRecordID>723</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:29 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRD1HKW-Microsoft.XboxIdentityProvider
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:29.083940600Z" />
    <EventRecordID>722</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:29.083937100Z" />
    <EventRecordID>721</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:29.083932000Z" />
    <EventRecordID>720</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER</Data>
    <Data Name="updateGuid">{AC2A7AB5-4029-4352-B278-86467EA8C573}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:23 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:23.761058800Z" />
    <EventRecordID>719</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:23 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:23.761057600Z" />
    <EventRecordID>718</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:23 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:23.761056500Z" />
    <EventRecordID>717</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER</Data>
    <Data Name="updateGuid">{AC2A7AB5-4029-4352-B278-86467EA8C573}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:23 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:23.761054200Z" />
    <EventRecordID>716</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:23 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NZKPSTSNW4P-Microsoft.XboxGamingOverlay
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:23.759165700Z" />
    <EventRecordID>715</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:23 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NZKPSTSNW4P-Microsoft.XboxGamingOverlay
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:23.759164300Z" />
    <EventRecordID>714</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:22 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxIdentityProvider_12.45.6001.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:22.563728700Z" />
    <EventRecordID>713</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">142</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxIdentityProvider_12.45.6001.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:19 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:19.462980800Z" />
    <EventRecordID>712</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">104</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:48:17 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGamingOverlay_2.22.11001.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:17.422201200Z" />
    <EventRecordID>711</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">139</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGamingOverlay_2.22.11001.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:14 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:14.061936700Z" />
    <EventRecordID>710</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER</Data>
    <Data Name="updateGuid">{AC2A7AB5-4029-4352-B278-86467EA8C573}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:11 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:11.320335400Z" />
    <EventRecordID>709</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:11 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:11.320334600Z" />
    <EventRecordID>708</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:11 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:11.320333700Z" />
    <EventRecordID>707</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:11 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:11.320330900Z" />
    <EventRecordID>706</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:05.368546100Z" />
    <EventRecordID>705</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:05.368545100Z" />
    <EventRecordID>704</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:05 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH5PNB1-Microsoft.OneConnect
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:05.368541200Z" />
    <EventRecordID>703</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5PNB1-Microsoft.OneConnect</Data>
    <Data Name="updateGuid">{4B248C49-9637-4040-9E0E-647B9FA51B1A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:03.281731700Z" />
    <EventRecordID>702</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRD1HKW-Microsoft.XboxIdentityProvider</Data>
    <Data Name="updateGuid">{85E562C7-14E0-4D44-9AD7-B1D30EF60A1B}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:03.281729400Z" />
    <EventRecordID>701</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:03.281727800Z" />
    <EventRecordID>700</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:03.281725500Z" />
    <EventRecordID>699</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:48:03 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:18:03.281721400Z" />
    <EventRecordID>698</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:57 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH5PNB1-Microsoft.OneConnect
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:57.860260000Z" />
    <EventRecordID>697</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5PNB1-Microsoft.OneConnect</Data>
    <Data Name="updateGuid">{4B248C49-9637-4040-9E0E-647B9FA51B1A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:57 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRDTBJJ-MICROSOFT.GETSTARTED
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:57.860258700Z" />
    <EventRecordID>696</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBJJ-MICROSOFT.GETSTARTED</Data>
    <Data Name="updateGuid">{ADBB38CC-98C2-4A80-869B-BCB292A78773}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:57 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRDTBJJ-MICROSOFT.GETSTARTED
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:57.860257400Z" />
    <EventRecordID>695</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBJJ-MICROSOFT.GETSTARTED</Data>
    <Data Name="updateGuid">{ADBB38CC-98C2-4A80-869B-BCB292A78773}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:54 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:54.449073900Z" />
    <EventRecordID>694</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NZKPSTSNW4P-Microsoft.XboxGamingOverlay</Data>
    <Data Name="updateGuid">{38E12B92-D9CB-411E-9A3A-E0FA8C976AF3}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:47:53 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.1809.2571.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:53.507232500Z" />
    <EventRecordID>693</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">133</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.1809.2571.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:47:52 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:52.381431400Z" />
    <EventRecordID>692</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">132</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:50 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:50.241547500Z" />
    <EventRecordID>691</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBJJ-MICROSOFT.GETSTARTED</Data>
    <Data Name="updateGuid">{ADBB38CC-98C2-4A80-869B-BCB292A78773}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:50 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:50.241546500Z" />
    <EventRecordID>690</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:50 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:50.241544000Z" />
    <EventRecordID>689</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5PNB1-Microsoft.OneConnect</Data>
    <Data Name="updateGuid">{4B248C49-9637-4040-9E0E-647B9FA51B1A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:46 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:46.081405000Z" />
    <EventRecordID>688</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBJJ-MICROSOFT.GETSTARTED</Data>
    <Data Name="updateGuid">{ADBB38CC-98C2-4A80-869B-BCB292A78773}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:46 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:46.081404100Z" />
    <EventRecordID>687</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:46 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:46.081402900Z" />
    <EventRecordID>686</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5PNB1-Microsoft.OneConnect</Data>
    <Data Name="updateGuid">{4B248C49-9637-4040-9E0E-647B9FA51B1A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:46 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBH4-Microsoft.Windows.Photos
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:46.081399800Z" />
    <EventRecordID>685</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:40 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJBH4-Microsoft.Windows.Photos
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:40.033906300Z" />
    <EventRecordID>684</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:40 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:40.033902500Z" />
    <EventRecordID>683</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH5PNB1-Microsoft.OneConnect</Data>
    <Data Name="updateGuid">{4B248C49-9637-4040-9E0E-647B9FA51B1A}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:36 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:36.857837100Z" />
    <EventRecordID>682</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBJJ-MICROSOFT.GETSTARTED</Data>
    <Data Name="updateGuid">{ADBB38CC-98C2-4A80-869B-BCB292A78773}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:36 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:36.857835100Z" />
    <EventRecordID>681</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:36 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:36.857831000Z" />
    <EventRecordID>680</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:47:36 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:36.519880400Z" />
    <EventRecordID>679</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">142</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:35 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:35.387422200Z" />
    <EventRecordID>678</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBJJ-MICROSOFT.GETSTARTED</Data>
    <Data Name="updateGuid">{ADBB38CC-98C2-4A80-869B-BCB292A78773}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:35 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:35.387421200Z" />
    <EventRecordID>677</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:35 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:35.387420000Z" />
    <EventRecordID>676</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:35 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBQ6-Microsoft.Messaging
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:35.387416600Z" />
    <EventRecordID>675</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBQ6-Microsoft.Messaging</Data>
    <Data Name="updateGuid">{08C32E65-042D-4829-AAC6-75F52A8B8DFC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:29.796784700Z" />
    <EventRecordID>674</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:29.796783900Z" />
    <EventRecordID>673</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:29.796782700Z" />
    <EventRecordID>672</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:29.796781700Z" />
    <EventRecordID>671</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:29 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJBQ6-Microsoft.Messaging
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:29.796779600Z" />
    <EventRecordID>670</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBQ6-Microsoft.Messaging</Data>
    <Data Name="updateGuid">{08C32E65-042D-4829-AAC6-75F52A8B8DFC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:28 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:28.919606100Z" />
    <EventRecordID>669</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS</Data>
    <Data Name="updateGuid">{47D74590-A816-4391-9756-8ACA414B8C14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:47:28 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:28.919604100Z" />
    <EventRecordID>668</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS</Data>
    <Data Name="updateGuid">{47D74590-A816-4391-9756-8ACA414B8C14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:47:24 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Messaging_4.1810.2922.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:24.458391500Z" />
    <EventRecordID>667</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">132</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Messaging_4.1810.2922.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:47:24 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:24.425030300Z" />
    <EventRecordID>666</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">98</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:47:21 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsMaps_5.1809.2762.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:17:21.716381300Z" />
    <EventRecordID>665</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">134</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsMaps_5.1809.2762.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:39 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:39.047231600Z" />
    <EventRecordID>664</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBQ6-Microsoft.Messaging</Data>
    <Data Name="updateGuid">{08C32E65-042D-4829-AAC6-75F52A8B8DFC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:33.911321600Z" />
    <EventRecordID>663</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:33.911318700Z" />
    <EventRecordID>662</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS</Data>
    <Data Name="updateGuid">{47D74590-A816-4391-9756-8ACA414B8C14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:29.180223800Z" />
    <EventRecordID>661</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:29.180221600Z" />
    <EventRecordID>660</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:29.180219700Z" />
    <EventRecordID>659</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS</Data>
    <Data Name="updateGuid">{47D74590-A816-4391-9756-8ACA414B8C14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:29.180215500Z" />
    <EventRecordID>658</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:28 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:28.534659900Z" />
    <EventRecordID>657</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:28 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:28.534657200Z" />
    <EventRecordID>656</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:23 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:23.929480200Z" />
    <EventRecordID>655</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRDTBVB-MICROSOFT.WINDOWSMAPS</Data>
    <Data Name="updateGuid">{47D74590-A816-4391-9756-8ACA414B8C14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:15 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:15.467834600Z" />
    <EventRecordID>654</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:15 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:15.467832700Z" />
    <EventRecordID>653</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:12 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:12.920897300Z" />
    <EventRecordID>652</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:12 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:12.920894700Z" />
    <EventRecordID>651</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:04.212396500Z" />
    <EventRecordID>650</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:46:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:04.212395300Z" />
    <EventRecordID>649</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:46:02 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\microsoft.windowscommunicationsapps_16005.11001.20083.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:16:02.390226000Z" />
    <EventRecordID>648</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">154</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\microsoft.windowscommunicationsapps_16005.11001.20083.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:55 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:55.101865900Z" />
    <EventRecordID>647</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1</Data>
    <Data Name="updateGuid">{C31E5AC8-D4C1-41BB-A2CE-DB1976144A14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:55 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:55.101863200Z" />
    <EventRecordID>646</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1</Data>
    <Data Name="updateGuid">{C31E5AC8-D4C1-41BB-A2CE-DB1976144A14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:52 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9PBPCH085S3S-Microsoft.Print3D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:52.773480400Z" />
    <EventRecordID>645</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PBPCH085S3S-Microsoft.Print3D</Data>
    <Data Name="updateGuid">{6EF2920A-89F5-44B2-A06B-23D76B8CBEF6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:52 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9PBPCH085S3S-Microsoft.Print3D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:52.773478900Z" />
    <EventRecordID>644</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PBPCH085S3S-Microsoft.Print3D</Data>
    <Data Name="updateGuid">{6EF2920A-89F5-44B2-A06B-23D76B8CBEF6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:45:47 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:47.404766500Z" />
    <EventRecordID>643</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">94</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:45:45 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Print3D_3.1.2612.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:45.383855300Z" />
    <EventRecordID>642</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">127</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Print3D_3.1.2612.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:17 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:17.758805500Z" />
    <EventRecordID>641</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PBPCH085S3S-Microsoft.Print3D</Data>
    <Data Name="updateGuid">{6EF2920A-89F5-44B2-A06B-23D76B8CBEF6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:12 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:12.598162900Z" />
    <EventRecordID>640</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:12 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:12.598160500Z" />
    <EventRecordID>639</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:08.600688000Z" />
    <EventRecordID>638</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:08.600685900Z" />
    <EventRecordID>637</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:08.600684400Z" />
    <EventRecordID>636</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:08.600679600Z" />
    <EventRecordID>635</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:08 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9N4D0MSMP0PT-Microsoft.VP9VideoExtensions
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:08.575256800Z" />
    <EventRecordID>634</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N4D0MSMP0PT-Microsoft.VP9VideoExtensions</Data>
    <Data Name="updateGuid">{91F31255-37B9-4089-A424-809523840B02}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:45:08 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9N4D0MSMP0PT-Microsoft.VP9VideoExtensions
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:08.575254200Z" />
    <EventRecordID>633</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N4D0MSMP0PT-Microsoft.VP9VideoExtensions</Data>
    <Data Name="updateGuid">{91F31255-37B9-4089-A424-809523840B02}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:45:03 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:03.891409900Z" />
    <EventRecordID>632</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">105</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:45:02 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.VP9VideoExtensions_1.0.12611.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:15:02.025380500Z" />
    <EventRecordID>631</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">139</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.VP9VideoExtensions_1.0.12611.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:56 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:56.201726800Z" />
    <EventRecordID>630</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9N4D0MSMP0PT-Microsoft.VP9VideoExtensions</Data>
    <Data Name="updateGuid">{91F31255-37B9-4089-A424-809523840B02}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:48 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:48.999583200Z" />
    <EventRecordID>629</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:48 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:48.999578600Z" />
    <EventRecordID>628</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:44.003872600Z" />
    <EventRecordID>627</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:44.003871400Z" />
    <EventRecordID>626</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:44.003870400Z" />
    <EventRecordID>625</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:44 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:44.003867900Z" />
    <EventRecordID>624</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:43 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ3P2-MICROSOFT.ZUNEVIDEO
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:43.496224600Z" />
    <EventRecordID>623</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3P2-MICROSOFT.ZUNEVIDEO</Data>
    <Data Name="updateGuid">{6D358FC8-5F6C-4196-B786-8D8124F691CF}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:44:43 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJ3P2-MICROSOFT.ZUNEVIDEO
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:43.496222800Z" />
    <EventRecordID>622</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3P2-MICROSOFT.ZUNEVIDEO</Data>
    <Data Name="updateGuid">{6D358FC8-5F6C-4196-B786-8D8124F691CF}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:44:35 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:14:35.333960800Z" />
    <EventRecordID>621</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">135</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:21 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:21.044893800Z" />
    <EventRecordID>620</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3P2-MICROSOFT.ZUNEVIDEO</Data>
    <Data Name="updateGuid">{6D358FC8-5F6C-4196-B786-8D8124F691CF}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:13 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:13.086964100Z" />
    <EventRecordID>619</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:13 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:13.086962800Z" />
    <EventRecordID>618</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:13 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:13.086959800Z" />
    <EventRecordID>617</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:08.885171500Z" />
    <EventRecordID>616</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:08.885170600Z" />
    <EventRecordID>615</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:08 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:08.885169600Z" />
    <EventRecordID>614</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:08 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ364-MICROSOFT.SKYPEAPP
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:08.885167300Z" />
    <EventRecordID>613</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ364-MICROSOFT.SKYPEAPP</Data>
    <Data Name="updateGuid">{7A85288E-5FD7-4FC5-9B48-D591F668DC13}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:04 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJ364-MICROSOFT.SKYPEAPP
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:04.676387600Z" />
    <EventRecordID>612</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ364-MICROSOFT.SKYPEAPP</Data>
    <Data Name="updateGuid">{7A85288E-5FD7-4FC5-9B48-D591F668DC13}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:04 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:04.676386600Z" />
    <EventRecordID>611</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:04 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:04.676384800Z" />
    <EventRecordID>610</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:00 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:00.496832800Z" />
    <EventRecordID>609</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1</Data>
    <Data Name="updateGuid">{C31E5AC8-D4C1-41BB-A2CE-DB1976144A14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:43:00 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:13:00.496831600Z" />
    <EventRecordID>608</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1</Data>
    <Data Name="updateGuid">{C31E5AC8-D4C1-41BB-A2CE-DB1976144A14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:42:56 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:12:56.620037300Z" />
    <EventRecordID>607</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">128</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:57 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:57.974255600Z" />
    <EventRecordID>606</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVQM-MICROSOFT.WINDOWSCOMMUNICATIONSAPPS</Data>
    <Data Name="updateGuid">{ADEF7140-A144-4100-A741-EDDB21B2D211}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:51 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:51.931430600Z" />
    <EventRecordID>605</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:51 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:51.931428700Z" />
    <EventRecordID>604</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ364-MICROSOFT.SKYPEAPP</Data>
    <Data Name="updateGuid">{7A85288E-5FD7-4FC5-9B48-D591F668DC13}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:47 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:47.139090100Z" />
    <EventRecordID>603</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:47 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:47.139087900Z" />
    <EventRecordID>602</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:47 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:47.139086300Z" />
    <EventRecordID>601</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ364-MICROSOFT.SKYPEAPP</Data>
    <Data Name="updateGuid">{7A85288E-5FD7-4FC5-9B48-D591F668DC13}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:47 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:47.139081500Z" />
    <EventRecordID>600</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:46 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:46.419182000Z" />
    <EventRecordID>599</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE</Data>
    <Data Name="updateGuid">{2A3418AB-D39E-43E7-A8F5-0B650D54A314}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:46 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:46.419180700Z" />
    <EventRecordID>598</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE</Data>
    <Data Name="updateGuid">{2A3418AB-D39E-43E7-A8F5-0B650D54A314}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:41:40 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:40.351193100Z" />
    <EventRecordID>597</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">137</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:41:01 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:11:01.483894600Z" />
    <EventRecordID>596</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ364-MICROSOFT.SKYPEAPP</Data>
    <Data Name="updateGuid">{7A85288E-5FD7-4FC5-9B48-D591F668DC13}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:56 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:56.979087300Z" />
    <EventRecordID>595</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE</Data>
    <Data Name="updateGuid">{2A3418AB-D39E-43E7-A8F5-0B650D54A314}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:52 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:52.034270200Z" />
    <EventRecordID>594</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:52 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:52.034269400Z" />
    <EventRecordID>593</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:52 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:52.034268200Z" />
    <EventRecordID>592</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE</Data>
    <Data Name="updateGuid">{2A3418AB-D39E-43E7-A8F5-0B650D54A314}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:52 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:52.034267300Z" />
    <EventRecordID>591</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:52 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:52.034265700Z" />
    <EventRecordID>590</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:47 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:47.700293200Z" />
    <EventRecordID>589</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE</Data>
    <Data Name="updateGuid">{2A3418AB-D39E-43E7-A8F5-0B650D54A314}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:45 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:45.714715500Z" />
    <EventRecordID>588</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9MZ8BK1XV75W-Microsoft.NET.Native.Runtime.2.1</Data>
    <Data Name="updateGuid">{5D399D6C-8678-4ECF-8C3A-994A2C34CA10}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:45 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:45.714714700Z" />
    <EventRecordID>587</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:45 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:45.714713900Z" />
    <EventRecordID>586</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:45 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:45.714712700Z" />
    <EventRecordID>585</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:45 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:45.714709900Z" />
    <EventRecordID>584</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:39 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ3PR-MICROSOFT.WINDOWSALARMS
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:39.978893100Z" />
    <EventRecordID>583</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PR-MICROSOFT.WINDOWSALARMS</Data>
    <Data Name="updateGuid">{A5FADAA5-0F86-40C6-9CE3-5661CC2F08AD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:39 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJ3PR-MICROSOFT.WINDOWSALARMS
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:39.978891500Z" />
    <EventRecordID>582</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PR-MICROSOFT.WINDOWSALARMS</Data>
    <Data Name="updateGuid">{A5FADAA5-0F86-40C6-9CE3-5661CC2F08AD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:40:34 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAlarms_10.1809.2731.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:34.604482300Z" />
    <EventRecordID>581</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">137</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAlarms_10.1809.2731.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:14 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:14.632727200Z" />
    <EventRecordID>580</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PK21VDD7LD9-Microsoft.NET.Native.Framework.2.1</Data>
    <Data Name="updateGuid">{C31E5AC8-D4C1-41BB-A2CE-DB1976144A14}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:12 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ3Q2-Microsoft.BingWeather
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:12.481678000Z" />
    <EventRecordID>579</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3Q2-Microsoft.BingWeather</Data>
    <Data Name="updateGuid">{A447CF31-FF3B-40C4-86BC-F26207F3FDC0}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:12 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJ3Q2-Microsoft.BingWeather
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:12.481675500Z" />
    <EventRecordID>578</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3Q2-Microsoft.BingWeather</Data>
    <Data Name="updateGuid">{A447CF31-FF3B-40C4-86BC-F26207F3FDC0}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:04.575457400Z" />
    <EventRecordID>577</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PR-MICROSOFT.WINDOWSALARMS</Data>
    <Data Name="updateGuid">{A5FADAA5-0F86-40C6-9CE3-5661CC2F08AD}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:40:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:10:04.575453900Z" />
    <EventRecordID>576</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:59.294333100Z" />
    <EventRecordID>575</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:59.294332200Z" />
    <EventRecordID>574</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:59.294331400Z" />
    <EventRecordID>573</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:59.294330200Z" />
    <EventRecordID>572</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:59.294327400Z" />
    <EventRecordID>571</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:57 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBD8-Microsoft.XboxApp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:57.826395900Z" />
    <EventRecordID>570</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBD8-Microsoft.XboxApp</Data>
    <Data Name="updateGuid">{3D93778C-121A-4527-A165-5D2DDC793E75}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:57 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJBD8-Microsoft.XboxApp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:57.826393200Z" />
    <EventRecordID>569</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBD8-Microsoft.XboxApp</Data>
    <Data Name="updateGuid">{3D93778C-121A-4527-A165-5D2DDC793E75}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:53 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:53.504200600Z" />
    <EventRecordID>568</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:53 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:53.504199700Z" />
    <EventRecordID>567</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:39:49 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingWeather_4.26.12153.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:49.386950500Z" />
    <EventRecordID>566</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">133</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingWeather_4.26.12153.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:49.147952000Z" />
    <EventRecordID>565</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:49.147950300Z" />
    <EventRecordID>564</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:49.147947600Z" />
    <EventRecordID>563</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:49 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:49.147942800Z" />
    <EventRecordID>562</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:39:44 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxApp_44.44.7002.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:44.740001500Z" />
    <EventRecordID>561</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">129</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxApp_44.44.7002.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:34 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:34.525661800Z" />
    <EventRecordID>560</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBH4-Microsoft.Windows.Photos</Data>
    <Data Name="updateGuid">{F0EB5488-9D6E-4A2D-8BE2-829C76AA6037}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:29.913376400Z" />
    <EventRecordID>559</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:29 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:29.913373900Z" />
    <EventRecordID>558</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:26 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NKNC0LD5NN6-Microsoft.Xbox.TCUI
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:26.104040600Z" />
    <EventRecordID>557</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NKNC0LD5NN6-Microsoft.Xbox.TCUI</Data>
    <Data Name="updateGuid">{549544E2-2B5C-40F5-A053-51007E138EE5}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:26 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NKNC0LD5NN6-Microsoft.Xbox.TCUI
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:26.104037400Z" />
    <EventRecordID>556</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NKNC0LD5NN6-Microsoft.Xbox.TCUI</Data>
    <Data Name="updateGuid">{549544E2-2B5C-40F5-A053-51007E138EE5}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:39:21 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:21.055136600Z" />
    <EventRecordID>555</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">96</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:20.587801100Z" />
    <EventRecordID>554</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:20.587800100Z" />
    <EventRecordID>553</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:39:15 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Xbox.TCUI_1.11.29001.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:15.791766300Z" />
    <EventRecordID>552</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">131</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Xbox.TCUI_1.11.29001.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:11 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:11.182366900Z" />
    <EventRecordID>551</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3Q2-Microsoft.BingWeather</Data>
    <Data Name="updateGuid">{A447CF31-FF3B-40C4-86BC-F26207F3FDC0}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:08 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:08.414572800Z" />
    <EventRecordID>550</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:08 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:08.414571300Z" />
    <EventRecordID>549</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:39:03 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:03.031200300Z" />
    <EventRecordID>548</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">115</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:02 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:02.391821200Z" />
    <EventRecordID>547</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJBD8-Microsoft.XboxApp</Data>
    <Data Name="updateGuid">{3D93778C-121A-4527-A165-5D2DDC793E75}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:02 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:02.391819400Z" />
    <EventRecordID>546</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:39:02 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:09:02.391813700Z" />
    <EventRecordID>545</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:57 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH4LS1F-Microsoft.StorePurchaseApp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:57.297755100Z" />
    <EventRecordID>544</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4LS1F-Microsoft.StorePurchaseApp</Data>
    <Data Name="updateGuid">{D55238E3-76CE-4B94-AE8A-C9A14AA6D173}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:57 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:57.297753700Z" />
    <EventRecordID>543</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NKNC0LD5NN6-Microsoft.Xbox.TCUI</Data>
    <Data Name="updateGuid">{549544E2-2B5C-40F5-A053-51007E138EE5}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:57 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH4LS1F-Microsoft.StorePurchaseApp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:57.297752400Z" />
    <EventRecordID>542</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4LS1F-Microsoft.StorePurchaseApp</Data>
    <Data Name="updateGuid">{D55238E3-76CE-4B94-AE8A-C9A14AA6D173}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:57 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9P086NHDNB9W-Microsoft.XboxSpeechtoTextOverlay
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:57.297750100Z" />
    <EventRecordID>541</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9P086NHDNB9W-Microsoft.XboxSpeechtoTextOverlay</Data>
    <Data Name="updateGuid">{AF04CAB2-A18B-4E11-B9FB-EA185D9C8E40}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:53 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:53.181236400Z" />
    <EventRecordID>540</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">103</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:51 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:51.142653200Z" />
    <EventRecordID>539</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:51 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:51.142652000Z" />
    <EventRecordID>538</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:51 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9P086NHDNB9W-Microsoft.XboxSpeechtoTextOverlay
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:51.142650900Z" />
    <EventRecordID>537</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9P086NHDNB9W-Microsoft.XboxSpeechtoTextOverlay</Data>
    <Data Name="updateGuid">{AF04CAB2-A18B-4E11-B9FB-EA185D9C8E40}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:50 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:50.745011000Z" />
    <EventRecordID>536</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">110</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:48 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StorePurchaseApp_11810.1001.10.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:48.684429700Z" />
    <EventRecordID>535</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">141</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StorePurchaseApp_11810.1001.10.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:47 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.8172.0_x86__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:47.976755500Z" />
    <EventRecordID>534</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">148</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.8172.0_x86__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:47 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:47.454465400Z" />
    <EventRecordID>533</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">145</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:27 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:27.326041900Z" />
    <EventRecordID>532</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9P086NHDNB9W-Microsoft.XboxSpeechtoTextOverlay</Data>
    <Data Name="updateGuid">{AF04CAB2-A18B-4E11-B9FB-EA185D9C8E40}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:25 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:25.690126200Z" />
    <EventRecordID>531</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:25 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:25.690121900Z" />
    <EventRecordID>530</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4LS1F-Microsoft.StorePurchaseApp</Data>
    <Data Name="updateGuid">{D55238E3-76CE-4B94-AE8A-C9A14AA6D173}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:18.281409500Z" />
    <EventRecordID>529</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:18.281408300Z" />
    <EventRecordID>528</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:18.281407200Z" />
    <EventRecordID>527</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4LS1F-Microsoft.StorePurchaseApp</Data>
    <Data Name="updateGuid">{D55238E3-76CE-4B94-AE8A-C9A14AA6D173}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:18 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:18.281404600Z" />
    <EventRecordID>526</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:17 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH42THS-Microsoft.Microsoft3DViewer
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:17.765021000Z" />
    <EventRecordID>525</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:17 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:17.765018300Z" />
    <EventRecordID>524</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4LS1F-Microsoft.StorePurchaseApp</Data>
    <Data Name="updateGuid">{D55238E3-76CE-4B94-AE8A-C9A14AA6D173}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:17 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH42THS-Microsoft.Microsoft3DViewer
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:17.765015500Z" />
    <EventRecordID>523</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:13 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:13.586580300Z" />
    <EventRecordID>522</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">104</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:12 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:12.925100100Z" />
    <EventRecordID>521</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop</Data>
    <Data Name="updateGuid">{FA7BF998-D5A9-4440-B7B1-20E16F3CD7B8}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:12 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:12.925098500Z" />
    <EventRecordID>520</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop</Data>
    <Data Name="updateGuid">{FA7BF998-D5A9-4440-B7B1-20E16F3CD7B8}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:12 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:12.925096300Z" />
    <EventRecordID>519</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:10.112671100Z" />
    <EventRecordID>518</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:10.112670300Z" />
    <EventRecordID>517</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:10.112669000Z" />
    <EventRecordID>516</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:10.112667900Z" />
    <EventRecordID>515</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:10.112665500Z" />
    <EventRecordID>514</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:09 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9PKDZBMV1H3T-Microsoft.GetHelp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:09.623207400Z" />
    <EventRecordID>513</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PKDZBMV1H3T-Microsoft.GetHelp</Data>
    <Data Name="updateGuid">{62185C2A-CC3F-4ACF-AB09-EA4A531643F9}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:38:09 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9PKDZBMV1H3T-Microsoft.GetHelp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:09.623206000Z" />
    <EventRecordID>512</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PKDZBMV1H3T-Microsoft.GetHelp</Data>
    <Data Name="updateGuid">{62185C2A-CC3F-4ACF-AB09-EA4A531643F9}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:08 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Microsoft3DViewer_5.1810.23012.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:08.412481600Z" />
    <EventRecordID>511</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">141</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Microsoft3DViewer_5.1810.23012.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:06 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:06.474390600Z" />
    <EventRecordID>510</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">94</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:38:04 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.GetHelp_10.1706.12921.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:08:04.403393800Z" />
    <EventRecordID>509</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">132</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.GetHelp_10.1706.12921.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:31 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:31.278494600Z" />
    <EventRecordID>508</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PKDZBMV1H3T-Microsoft.GetHelp</Data>
    <Data Name="updateGuid">{62185C2A-CC3F-4ACF-AB09-EA4A531643F9}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:25 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:25.811569400Z" />
    <EventRecordID>507</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:25 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:25.811566100Z" />
    <EventRecordID>506</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:20.757100900Z" />
    <EventRecordID>505</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:20.757099700Z" />
    <EventRecordID>504</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:20.757098600Z" />
    <EventRecordID>503</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:20.757096700Z" />
    <EventRecordID>502</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:20 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:20.755068400Z" />
    <EventRecordID>501</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC</Data>
    <Data Name="updateGuid">{8018AF8E-0FC9-4417-ADE4-6FFD789CB88D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:20 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:20.755066600Z" />
    <EventRecordID>500</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC</Data>
    <Data Name="updateGuid">{8018AF8E-0FC9-4417-ADE4-6FFD789CB88D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:37:17 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:17.055822400Z" />
    <EventRecordID>499</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">96</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:37:14 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneMusic_10.18091.10321.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:14.791729600Z" />
    <EventRecordID>498</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">135</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneMusic_10.18091.10321.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:10.182685400Z" />
    <EventRecordID>497</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHWD2-Microsoft.MicrosoftSolitaireCollection</Data>
    <Data Name="updateGuid">{84D9BFFD-C1A7-412A-8FD4-06D7E88B5E2F}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:04.282250700Z" />
    <EventRecordID>496</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:04.282249900Z" />
    <EventRecordID>495</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC</Data>
    <Data Name="updateGuid">{8018AF8E-0FC9-4417-ADE4-6FFD789CB88D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:04.282248900Z" />
    <EventRecordID>494</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:04 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:04.282246000Z" />
    <EventRecordID>493</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:00 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:00.985755300Z" />
    <EventRecordID>492</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC</Data>
    <Data Name="updateGuid">{8018AF8E-0FC9-4417-ADE4-6FFD789CB88D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:00 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:00.985754100Z" />
    <EventRecordID>491</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:00 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH18846-KING.COM.CANDYCRUSHSAGA
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:00.985751900Z" />
    <EventRecordID>490</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:00 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH18846-KING.COM.CANDYCRUSHSAGA
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:00.985750700Z" />
    <EventRecordID>489</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:37:00 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH51CLL-Microsoft.Services.Store.Engagement
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:07:00.985748100Z" />
    <EventRecordID>488</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:36:56 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH3FRZM-Microsoft.VCLibs.140.00
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:06:56.475860900Z" />
    <EventRecordID>487</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:36:56 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:06:56.475858600Z" />
    <EventRecordID>486</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:36:56 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:06:56.475856900Z" />
    <EventRecordID>485</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:36:50 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\king.com.CandyCrushSaga_1.1380.6.0_x86__kgqvnymyfvs32\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:06:50.856942600Z" />
    <EventRecordID>484</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="7560" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">133</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\king.com.CandyCrushSaga_1.1380.6.0_x86__kgqvnymyfvs32\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:58 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:58.401779000Z" />
    <EventRecordID>483</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH42THS-Microsoft.Microsoft3DViewer</Data>
    <Data Name="updateGuid">{CCC04148-08A3-49E0-A103-F93F7B182056}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:20 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:20.650670300Z" />
    <EventRecordID>482</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC</Data>
    <Data Name="updateGuid">{8018AF8E-0FC9-4417-ADE4-6FFD789CB88D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:15 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:15.510851200Z" />
    <EventRecordID>481</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:15 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:15.510849700Z" />
    <EventRecordID>480</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:15 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:15.510847500Z" />
    <EventRecordID>479</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:15 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:15.510843600Z" />
    <EventRecordID>478</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:10 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NG1H8B3ZC7M-Microsoft.MixedReality.Portal
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:10.847516500Z" />
    <EventRecordID>477</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NG1H8B3ZC7M-Microsoft.MixedReality.Portal</Data>
    <Data Name="updateGuid">{CD416F41-1464-4994-8778-F988B6A2AD6D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:35:10 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NG1H8B3ZC7M-Microsoft.MixedReality.Portal
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:10.847515000Z" />
    <EventRecordID>476</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NG1H8B3ZC7M-Microsoft.MixedReality.Portal</Data>
    <Data Name="updateGuid">{CD416F41-1464-4994-8778-F988B6A2AD6D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:35:07 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:07.303919800Z" />
    <EventRecordID>475</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">106</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:35:04 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MixedReality.Portal_2000.18100.1171.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:05:04.829473900Z" />
    <EventRecordID>474</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">146</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MixedReality.Portal_2000.18100.1171.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:38.676975900Z" />
    <EventRecordID>473</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop</Data>
    <Data Name="updateGuid">{FA7BF998-D5A9-4440-B7B1-20E16F3CD7B8}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:38.676974500Z" />
    <EventRecordID>472</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:38 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:38.676971900Z" />
    <EventRecordID>471</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:33.136168100Z" />
    <EventRecordID>470</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NG1H8B3ZC7M-Microsoft.MixedReality.Portal</Data>
    <Data Name="updateGuid">{CD416F41-1464-4994-8778-F988B6A2AD6D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:33.136166900Z" />
    <EventRecordID>469</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:33.136166000Z" />
    <EventRecordID>468</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:33 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:33.136163400Z" />
    <EventRecordID>467</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NG1H8B3ZC7M-Microsoft.MixedReality.Portal</Data>
    <Data Name="updateGuid">{CD416F41-1464-4994-8778-F988B6A2AD6D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:27 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:27.963530500Z" />
    <EventRecordID>466</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NG1H8B3ZC7M-Microsoft.MixedReality.Portal</Data>
    <Data Name="updateGuid">{CD416F41-1464-4994-8778-F988B6A2AD6D}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:27 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9PG2DK419DRG-Microsoft.WebpImageExtension
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:27.963528200Z" />
    <EventRecordID>465</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PG2DK419DRG-Microsoft.WebpImageExtension</Data>
    <Data Name="updateGuid">{93DDC61A-5FE5-43F4-B349-11F754603746}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:27 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9PG2DK419DRG-Microsoft.WebpImageExtension
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:27.963523100Z" />
    <EventRecordID>464</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PG2DK419DRG-Microsoft.WebpImageExtension</Data>
    <Data Name="updateGuid">{93DDC61A-5FE5-43F4-B349-11F754603746}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:34:23 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:23.243043400Z" />
    <EventRecordID>463</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">105</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:22.859355700Z" />
    <EventRecordID>462</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:22.859354800Z" />
    <EventRecordID>461</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:22.859353900Z" />
    <EventRecordID>460</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PG2DK419DRG-Microsoft.WebpImageExtension</Data>
    <Data Name="updateGuid">{93DDC61A-5FE5-43F4-B349-11F754603746}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:22.859352500Z" />
    <EventRecordID>459</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:22.859351600Z" />
    <EventRecordID>458</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:22.859350200Z" />
    <EventRecordID>457</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PG2DK419DRG-Microsoft.WebpImageExtension</Data>
    <Data Name="updateGuid">{93DDC61A-5FE5-43F4-B349-11F754603746}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:34:21 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WebpImageExtension_1.0.12821.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:21.026926100Z" />
    <EventRecordID>456</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">139</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WebpImageExtension_1.0.12821.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:18 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFHVFW-Microsoft.BingNews
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:18.180369100Z" />
    <EventRecordID>455</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVFW-Microsoft.BingNews</Data>
    <Data Name="updateGuid">{F628B1A4-4341-4033-B4B4-294ABFAAD149}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:18 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFHVFW-Microsoft.BingNews
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:18.180367700Z" />
    <EventRecordID>454</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVFW-Microsoft.BingNews</Data>
    <Data Name="updateGuid">{F628B1A4-4341-4033-B4B4-294ABFAAD149}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:18 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH1QWGC-Microsoft.Advertising.Xaml
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:18.180364500Z" />
    <EventRecordID>453</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:12 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH1QWGC-Microsoft.Advertising.Xaml
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:12.932021500Z" />
    <EventRecordID>452</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:12 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH3FRZM-Microsoft.VCLibs.140.00
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:12.932020300Z" />
    <EventRecordID>451</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:07 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:07.902689300Z" />
    <EventRecordID>450</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9PG2DK419DRG-Microsoft.WebpImageExtension</Data>
    <Data Name="updateGuid">{93DDC61A-5FE5-43F4-B349-11F754603746}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:34:05 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:05.873753400Z" />
    <EventRecordID>449</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">137</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:01 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:01.688539700Z" />
    <EventRecordID>448</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:01 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:01.688538100Z" />
    <EventRecordID>447</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:01 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:01.688535900Z" />
    <EventRecordID>446</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:34:01 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:04:01.688531100Z" />
    <EventRecordID>445</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:57 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ3PS-Microsoft.RemoteDesktop
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:57.868364200Z" />
    <EventRecordID>444</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PS-Microsoft.RemoteDesktop</Data>
    <Data Name="updateGuid">{71D433A1-86FE-4B50-A040-23B355718860}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:57 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9WZDNCRFJ3PS-Microsoft.RemoteDesktop
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:57.868355700Z" />
    <EventRecordID>443</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PS-Microsoft.RemoteDesktop</Data>
    <Data Name="updateGuid">{71D433A1-86FE-4B50-A040-23B355718860}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:33:57 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:57.862347400Z" />
    <EventRecordID>442</EventRecordID>
    <Correlation />
    <Execution ProcessID="4388" ThreadID="7428" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">96</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:33:53 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Advertising.Xaml_10.1808.3.0_x86__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:53.584338700Z" />
    <EventRecordID>441</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">137</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Advertising.Xaml_10.1808.3.0_x86__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:50 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH51CLL-Microsoft.Services.Store.Engagement
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:50.871394700Z" />
    <EventRecordID>440</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:50 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH51CLL-Microsoft.Services.Store.Engagement
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:50.871393600Z" />
    <EventRecordID>439</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:50 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH3FRZM-Microsoft.VCLibs.140.00
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:50.871392000Z" />
    <EventRecordID>438</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:39 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:39.241325000Z" />
    <EventRecordID>437</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH1QWGC-Microsoft.Advertising.Xaml</Data>
    <Data Name="updateGuid">{6168D031-D18D-42F6-90C9-4988BD7FB162}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:39 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH3FRZM-Microsoft.VCLibs.140.00
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:39.241323700Z" />
    <EventRecordID>436</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:39 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: 9NBLGGH3FL3T-Microsoft.VCLibs.120.00.Universal
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:39.241321800Z" />
    <EventRecordID>435</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FL3T-Microsoft.VCLibs.120.00.Universal</Data>
    <Data Name="updateGuid">{8EE3D0EF-5511-453A-B9DD-00AFFED0477E}</Data>
    <Data Name="updateRevisionNumber">2</Data>
    <Data Name="serviceGuid">{855E8A7C-ECB4-4CA3-B045-1DFA50104289}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:35 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: 9NBLGGH3FL3T-Microsoft.VCLibs.120.00.Universal
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:35.915136000Z" />
    <EventRecordID>434</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FL3T-Microsoft.VCLibs.120.00.Universal</Data>
    <Data Name="updateGuid">{8EE3D0EF-5511-453A-B9DD-00AFFED0477E}</Data>
    <Data Name="updateRevisionNumber">2</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:33:35 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingNews_4.27.2643.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:35.074992300Z" />
    <EventRecordID>433</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="196" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">129</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingNews_4.27.2643.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:33:32 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:32.436224500Z" />
    <EventRecordID>432</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">147</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:33:30 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:30.218115000Z" />
    <EventRecordID>431</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">147</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:27 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:27.472915700Z" />
    <EventRecordID>430</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH51CLL-Microsoft.Services.Store.Engagement</Data>
    <Data Name="updateGuid">{5288C54D-24C6-4AAC-854A-97B166ACE4AC}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:33:20 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.RemoteDesktop_10.1.1088.0_x86__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:20.891622500Z" />
    <EventRecordID>429</EventRecordID>
    <Correlation />
    <Execution ProcessID="5620" ThreadID="6600" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">134</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.RemoteDesktop_10.1.1088.0_x86__8wekyb3d8bbwe\ActivationStore.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:10 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:10.209666300Z" />
    <EventRecordID>428</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH18846-KING.COM.CANDYCRUSHSAGA</Data>
    <Data Name="updateGuid">{B202BFC8-E7FF-492C-8D9D-DE2B42698ED6}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:05.123477600Z" />
    <EventRecordID>427</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVFW-Microsoft.BingNews</Data>
    <Data Name="updateGuid">{F628B1A4-4341-4033-B4B4-294ABFAAD149}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:05.123476700Z" />
    <EventRecordID>426</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:33:05 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:03:05.123475200Z" />
    <EventRecordID>425</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PS-Microsoft.RemoteDesktop</Data>
    <Data Name="updateGuid">{71D433A1-86FE-4B50-A040-23B355718860}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:59.729735700Z" />
    <EventRecordID>424</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVFW-Microsoft.BingNews</Data>
    <Data Name="updateGuid">{F628B1A4-4341-4033-B4B4-294ABFAAD149}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:59.729734900Z" />
    <EventRecordID>423</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:59 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:59.729733700Z" />
    <EventRecordID>422</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PS-Microsoft.RemoteDesktop</Data>
    <Data Name="updateGuid">{71D433A1-86FE-4B50-A040-23B355718860}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:55 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:55.757599800Z" />
    <EventRecordID>421</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFHVFW-Microsoft.BingNews</Data>
    <Data Name="updateGuid">{F628B1A4-4341-4033-B4B4-294ABFAAD149}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:55 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:55.757598600Z" />
    <EventRecordID>420</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9WZDNCRFJ3PS-Microsoft.RemoteDesktop</Data>
    <Data Name="updateGuid">{71D433A1-86FE-4B50-A040-23B355718860}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:55 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:55.757596800Z" />
    <EventRecordID>419</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:52 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:52.239538700Z" />
    <EventRecordID>418</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:47 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:47.087064300Z" />
    <EventRecordID>417</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FRZM-Microsoft.VCLibs.140.00</Data>
    <Data Name="updateGuid">{6080B7A3-7008-42B1-9B2F-976350D96033}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:45 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:45.017104000Z" />
    <EventRecordID>416</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">9NBLGGH3FL3T-Microsoft.VCLibs.120.00.Universal</Data>
    <Data Name="updateGuid">{8EE3D0EF-5511-453A-B9DD-00AFFED0477E}</Data>
    <Data Name="updateRevisionNumber">2</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:32:17 PM
Event ID:      19
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Successful: Windows successfully installed the following update: Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.281.118.0)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>19</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000000018</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:02:17.453825300Z" />
    <EventRecordID>415</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.281.118.0)</Data>
    <Data Name="updateGuid">{5AB31941-295E-4B53-A5E1-090FCC05A381}</Data>
    <Data Name="updateRevisionNumber">200</Data>
    <Data Name="serviceGuid">{9482F4B4-E343-43B6-B170-9A65BC822C77}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:31:26 PM
Event ID:      43
Task Category: Windows Update Agent
Level:         Information
Keywords:      Installation,Installation
User:          SYSTEM
Computer:      user-PC
Description:
Installation Started: Windows has started installing the following update: Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.281.118.0)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>43</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>13</Opcode>
    <Keywords>0x8000000000002008</Keywords>
    <TimeCreated SystemTime="2018-11-15T09:01:26.126120400Z" />
    <EventRecordID>414</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.281.118.0)</Data>
    <Data Name="updateGuid">{5AB31941-295E-4B53-A5E1-090FCC05A381}</Data>
    <Data Name="updateRevisionNumber">200</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 7:28:22 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:58:22.944313100Z" />
    <EventRecordID>413</EventRecordID>
    <Correlation />
    <Execution ProcessID="7200" ThreadID="7744" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.281.118.0)</Data>
    <Data Name="updateGuid">{5AB31941-295E-4B53-A5E1-090FCC05A381}</Data>
    <Data Name="updateRevisionNumber">200</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:28:21 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:58:21.908007000Z" />
    <EventRecordID>412</EventRecordID>
    <Correlation />
    <Execution ProcessID="6932" ThreadID="6632" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">85</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 7:22:15 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:52:15.631445700Z" />
    <EventRecordID>411</EventRecordID>
    <Correlation />
    <Execution ProcessID="620" ThreadID="3580" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">BITS</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          15/11/2018 7:21:01 PM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:51:01.255374700Z" />
    <EventRecordID>410</EventRecordID>
    <Correlation />
    <Execution ProcessID="76" ThreadID="416" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Launch</Data>
    <Data Name="param4">Windows.SecurityCenter.SecurityAppBroker</Data>
    <Data Name="param5">Unavailable</Data>
    <Data Name="param6">NT AUTHORITY</Data>
    <Data Name="param7">SYSTEM</Data>
    <Data Name="param8">S-1-5-18</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          15/11/2018 7:21:01 PM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:51:01.255374700Z" />
    <EventRecordID>409</EventRecordID>
    <Correlation />
    <Execution ProcessID="76" ThreadID="1580" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Launch</Data>
    <Data Name="param4">Windows.SecurityCenter.WscDataProtection</Data>
    <Data Name="param5">Unavailable</Data>
    <Data Name="param6">NT AUTHORITY</Data>
    <Data Name="param7">SYSTEM</Data>
    <Data Name="param8">S-1-5-18</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          15/11/2018 7:21:01 PM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:51:01.255374700Z" />
    <EventRecordID>408</EventRecordID>
    <Correlation />
    <Execution ProcessID="76" ThreadID="2300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Launch</Data>
    <Data Name="param4">Windows.SecurityCenter.WscBrokerManager</Data>
    <Data Name="param5">Unavailable</Data>
    <Data Name="param6">NT AUTHORITY</Data>
    <Data Name="param7">SYSTEM</Data>
    <Data Name="param8">S-1-5-18</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        BROWSER
Date:          15/11/2018 7:20:20 PM
Event ID:      8032
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}. The backup browser is stopping.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="49152">8032</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:50:20.179329100Z" />
    <EventRecordID>407</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}</Data>
    <Binary>88080000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          15/11/2018 7:20:12 PM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user user-PC\user SID (S-1-5-21-1074371277-1214576197-998651128-1000) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:50:12.410925000Z" />
    <EventRecordID>406</EventRecordID>
    <Correlation />
    <Execution ProcessID="76" ThreadID="1580" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
    <Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
    <Data Name="param6">user-PC</Data>
    <Data Name="param7">user</Data>
    <Data Name="param8">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        BROWSER
Date:          15/11/2018 7:19:19 PM
Event ID:      8021
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The browser service was unable to retrieve a list of servers from the browser master \\IMAGER on the network \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}.
 
 Browser master: \\IMAGER
 Network: \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}
 
 This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="32768">8021</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:49:19.103705200Z" />
    <EventRecordID>405</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\IMAGER</Data>
    <Data>\Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}</Data>
    <Binary>88080000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 7:18:06 PM
Event ID:      7026
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The following boot-start or system-start driver(s) did not load: 
dam
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7026</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:48:06.608219500Z" />
    <EventRecordID>404</EventRecordID>
    <Correlation />
    <Execution ProcessID="620" ThreadID="624" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">
dam</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WMPNSS-Service
Date:          15/11/2018 7:17:41 PM
Event ID:      14204
Task Category: None
Level:         Information
Keywords:      
User:          NETWORK SERVICE
Computer:      user-PC
Description:
The description for Event ID 14204 from source Microsoft-Windows-WMPNSS-Service cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

WMPNetworkSvc

the message resource is present but the message is not found in the string/message table

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMPNSS-Service" Guid="{6A2DC7C1-930A-4FB5-BB44-80B30AEBED6C}" />
    <EventID>14204</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:41.791679000Z" />
    <EventRecordID>403</EventRecordID>
    <Correlation />
    <Execution ProcessID="5364" ThreadID="5408" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-20" />
  </System>
  <EventData>
    <Data Name="ServiceName">WMPNetworkSvc</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          15/11/2018 7:17:30 PM
Event ID:      5211
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 5211 from source Microsoft-Windows-WAS cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

Classic
ConfigurationSystem

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
    <EventID Qualifiers="16384">5211</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:30.711692300Z" />
    <EventRecordID>402</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="RunningMode">Classic</Data>
    <Data Name="ConfigurationReader">ConfigurationSystem</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WLAN-AutoConfig
Date:          15/11/2018 7:17:24 PM
Event ID:      10000
Task Category: None
Level:         Error
Keywords:      (536870912)
User:          SYSTEM
Computer:      user-PC
Description:
WLAN Extensibility Module has failed to start.

Module Path: C:\WINDOWS\system32\Rtlihvs.dll
Error Code: 126

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
    <EventID>10000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000020000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:24.604591300Z" />
    <EventRecordID>401</EventRecordID>
    <Correlation />
    <Execution ProcessID="2312" ThreadID="2332" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ExtensibleModulePath">C:\WINDOWS\system32\Rtlihvs.dll</Data>
    <Data Name="ErrorCode">126</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          15/11/2018 7:17:22 PM
Event ID:      7001
Task Category: (1101)
Level:         Information
Keywords:      (35184372088832)
User:          SYSTEM
Computer:      user-PC
Description:
User Logon Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000200000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:22.141387500Z" />
    <EventRecordID>400</EventRecordID>
    <Correlation />
    <Execution ProcessID="716" ThreadID="564" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">1</Data>
    <Data Name="UserSid">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WLAN-AutoConfig
Date:          15/11/2018 7:17:20 PM
Event ID:      4000
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
WLAN AutoConfig service has successfully started.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
    <EventID>4000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:20.563830200Z" />
    <EventRecordID>399</EventRecordID>
    <Correlation />
    <Execution ProcessID="2312" ThreadID="2332" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:17:11 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'storqosflt' (10.0, ?2008?-?11?-?03T00:25:58.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:11.113738100Z" />
    <EventRecordID>398</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">10</Data>
    <Data Name="DeviceName">storqosflt</Data>
    <Data Name="DeviceTime">2008-11-03T00:25:58.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:17:11 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'CldFlt' (10.0, ?2069?-?04?-?24T09:07:50.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:11.110645600Z" />
    <EventRecordID>397</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">6</Data>
    <Data Name="DeviceName">CldFlt</Data>
    <Data Name="DeviceTime">2069-04-24T09:07:50.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:17:11 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'CldFlt' (Version 10.0, ?2069?-?04?-?24T09:07:50.000000000Z) unloaded successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>1</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:11.110581000Z" />
    <EventRecordID>396</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">6</Data>
    <Data Name="DeviceName">CldFlt</Data>
    <Data Name="DeviceTime">2069-04-24T09:07:50.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:17:11 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'CldFlt' (10.0, ?2069?-?04?-?24T09:07:50.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:11.110572600Z" />
    <EventRecordID>395</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">6</Data>
    <Data Name="DeviceName">CldFlt</Data>
    <Data Name="DeviceTime">2069-04-24T09:07:50.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:17:11 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'luafv' (10.0, ?2057?-?01?-?25T06:42:22.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:11.092712300Z" />
    <EventRecordID>394</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">5</Data>
    <Data Name="DeviceName">luafv</Data>
    <Data Name="DeviceTime">2057-01-25T06:42:22.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:17:10 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'wcifs' (10.0, ?2060?-?03?-?16T20:29:46.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:10.519636300Z" />
    <EventRecordID>393</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="176" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">5</Data>
    <Data Name="DeviceName">wcifs</Data>
    <Data Name="DeviceTime">2060-03-16T20:29:46.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCPv6-Client
Date:          15/11/2018 7:17:09 PM
Event ID:      51046
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv6 client service is started
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
    <EventID>51046</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>62</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:09.168423000Z" />
    <EventRecordID>392</EventRecordID>
    <Correlation />
    <Execution ProcessID="1252" ThreadID="1284" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          15/11/2018 7:17:09 PM
Event ID:      50103
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 client registered for shutdown notification
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50103</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>129</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:09.162458100Z" />
    <EventRecordID>391</EventRecordID>
    <Correlation />
    <Execution ProcessID="1252" ThreadID="1272" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          15/11/2018 7:17:09 PM
Event ID:      50036
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 client service is started
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>68</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:09.162335900Z" />
    <EventRecordID>390</EventRecordID>
    <Correlation />
    <Execution ProcessID="1252" ThreadID="1272" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Directory-Services-SAM
Date:          15/11/2018 7:17:08 PM
Event ID:      16962
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Directory-Services-SAM" Guid="{0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE}" />
    <EventID>16962</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:08.504958200Z" />
    <EventRecordID>389</EventRecordID>
    <Correlation ActivityID="{C0D94B45-7CBF-0000-B64B-D9C0BF7CD401}" />
    <Execution ProcessID="628" ThreadID="632" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="SAMMSG_RESTRICT_REMOTE_SAM_DEFAULT_SD">
    <Data Name="Default SD String:">O:SYG:SYD:(A;;RC;;;BA)</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Wininit
Date:          15/11/2018 7:17:08 PM
Event ID:      14
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Credential Guard (LsaIso.exe) configuration: 0x0, 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206F6DEA-D3C5-4D10-BC72-989F03C8B84B}" />
    <EventID>14</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:08.381077500Z" />
    <EventRecordID>388</EventRecordID>
    <Correlation />
    <Execution ProcessID="548" ThreadID="552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Config">0</Data>
    <Data Name="IsTestConfig">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          15/11/2018 7:17:05 PM
Event ID:      98
Task Category: None
Level:         Information
Keywords:      (2)
User:          SYSTEM
Computer:      user-PC
Description:
Volume \\?\Volume{e9a0c269-0000-0000-0000-a0053a000000} (\Device\HarddiskVolume3) is healthy.  No action is needed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}" />
    <EventID>98</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:05.518616500Z" />
    <EventRecordID>387</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="296" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">\\?\Volume{e9a0c269-0000-0000-0000-a0053a000000}</Data>
    <Data Name="DeviceName">\Device\HarddiskVolume3</Data>
    <Data Name="CorruptionActionState">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-PnP
Date:          15/11/2018 7:17:05 PM
Event ID:      219
Task Category: (212)
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The driver \Driver\WUDFRd failed to load for the device {C5A047D8-CB5B-40E9-B9E3-316AB06B5A18}\WirelessKeyboardFilter\9&154ffa24&0&01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9C205A39-1250-487D-ABD7-E831C6290539}" />
    <EventID>219</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>212</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:05.263544000Z" />
    <EventRecordID>386</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriverNameLength">77</Data>
    <Data Name="DriverName">{C5A047D8-CB5B-40E9-B9E3-316AB06B5A18}\WirelessKeyboardFilter\9&amp;154ffa24&amp;0&amp;01</Data>
    <Data Name="Status">3221226341</Data>
    <Data Name="FailureNameLength">14</Data>
    <Data Name="FailureName">\Driver\WUDFRd</Data>
    <Data Name="Version">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DriverFrameworks-UserMode
Date:          15/11/2018 7:17:05 PM
Event ID:      10118
Task Category: Startup of the UMDF reflector
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}" />
    <EventID>10118</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:05.263384200Z" />
    <EventRecordID>385</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="300" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          15/11/2018 7:17:03 PM
Event ID:      55
Task Category: (47)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 3101
Maximum performance percentage: 100
Minimum performance percentage: 51
Minimum throttle percentage: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>55</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>47</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:03.549584000Z" />
    <EventRecordID>384</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="296" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">3</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="IdleImplementation">1</Data>
    <Data Name="NominalFrequency">3101</Data>
    <Data Name="MaximumPerformancePercent">100</Data>
    <Data Name="MinimumPerformancePercent">51</Data>
    <Data Name="MinimumThrottlePercent">6</Data>
    <Data Name="PerformanceImplementation">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          15/11/2018 7:17:03 PM
Event ID:      55
Task Category: (47)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 3101
Maximum performance percentage: 100
Minimum performance percentage: 51
Minimum throttle percentage: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>55</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>47</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:03.548177000Z" />
    <EventRecordID>383</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="296" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">2</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="IdleImplementation">1</Data>
    <Data Name="NominalFrequency">3101</Data>
    <Data Name="MaximumPerformancePercent">100</Data>
    <Data Name="MinimumPerformancePercent">51</Data>
    <Data Name="MinimumThrottlePercent">6</Data>
    <Data Name="PerformanceImplementation">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          15/11/2018 7:17:03 PM
Event ID:      55
Task Category: (47)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 3101
Maximum performance percentage: 100
Minimum performance percentage: 51
Minimum throttle percentage: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>55</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>47</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:03.547299400Z" />
    <EventRecordID>382</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="296" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">1</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="IdleImplementation">1</Data>
    <Data Name="NominalFrequency">3101</Data>
    <Data Name="MaximumPerformancePercent">100</Data>
    <Data Name="MinimumPerformancePercent">51</Data>
    <Data Name="MinimumThrottlePercent">6</Data>
    <Data Name="PerformanceImplementation">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          15/11/2018 7:17:03 PM
Event ID:      55
Task Category: (47)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 3101
Maximum performance percentage: 100
Minimum performance percentage: 51
Minimum throttle percentage: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>55</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>47</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:03.546285500Z" />
    <EventRecordID>381</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="296" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">0</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="IdleImplementation">1</Data>
    <Data Name="NominalFrequency">3101</Data>
    <Data Name="MaximumPerformancePercent">100</Data>
    <Data Name="MinimumPerformancePercent">51</Data>
    <Data Name="MinimumThrottlePercent">6</Data>
    <Data Name="PerformanceImplementation">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        e1cexpress
Date:          15/11/2018 7:17:02 PM
Event ID:      27
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 27 from source e1cexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

Intel(R) 82579LM Gigabit Network Connection

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="e1cexpress" />
    <EventID Qualifiers="40964">27</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:02.961582900Z" />
    <EventRecordID>380</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>Intel(R) 82579LM Gigabit Network Connection</Data>
    <Binary>0000040002003000000000001B0004A00000000000000000000000000000000000000000000000001B0004A0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        MEIx64
Date:          15/11/2018 7:16:56 PM
Event ID:      2
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Intel(R) Management Engine Interface driver has started successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MEIx64" />
    <EventID Qualifiers="16391">2</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:56.586794800Z" />
    <EventRecordID>379</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Binary>00000000010000000000000002000740000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          15/11/2018 7:16:55 PM
Event ID:      172
Task Category: (203)
Level:         Information
Keywords:      (1024),(4)
User:          SYSTEM
Computer:      user-PC
Description:
Connectivity state in standby: Disconnected, Reason: NIC compliance
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>172</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>203</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000404</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:55.726000400Z" />
    <EventRecordID>378</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="State">2</Data>
    <Data Name="Reason">6</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          15/11/2018 7:16:55 PM
Event ID:      98
Task Category: None
Level:         Information
Keywords:      (2)
User:          SYSTEM
Computer:      user-PC
Description:
Volume \\?\Volume{7d81afc3-2744-11e7-916f-806e6f6e6963} (\Device\HarddiskVolume1) is healthy.  No action is needed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}" />
    <EventID>98</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:55.010954900Z" />
    <EventRecordID>377</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">\\?\Volume{7d81afc3-2744-11e7-916f-806e6f6e6963}</Data>
    <Data Name="DeviceName">\Device\HarddiskVolume1</Data>
    <Data Name="CorruptionActionState">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:16:54 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'npsvctrig' (10.0, ?2037?-?02?-?23T16:41:04.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:54.835136100Z" />
    <EventRecordID>376</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">9</Data>
    <Data Name="DeviceName">npsvctrig</Data>
    <Data Name="DeviceTime">2037-02-23T16:41:04.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:16:54 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'FileCrypt' (10.0, ?2034?-?08?-?14T01:00:12.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:54.326408400Z" />
    <EventRecordID>375</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">9</Data>
    <Data Name="DeviceName">FileCrypt</Data>
    <Data Name="DeviceTime">2034-08-14T01:00:12.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          15/11/2018 7:16:53 PM
Event ID:      98
Task Category: None
Level:         Information
Keywords:      (2)
User:          SYSTEM
Computer:      user-PC
Description:
Volume C: (\Device\HarddiskVolume2) is healthy.  No action is needed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}" />
    <EventID>98</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:53.170193900Z" />
    <EventRecordID>374</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="272" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">C:</Data>
    <Data Name="DeviceName">\Device\HarddiskVolume2</Data>
    <Data Name="CorruptionActionState">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:16:52 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'WdFilter' (10.0, ?2070?-?12?-?05T06:11:44.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:52.097319900Z" />
    <EventRecordID>373</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">8</Data>
    <Data Name="DeviceName">WdFilter</Data>
    <Data Name="DeviceTime">2070-12-05T06:11:44.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:16:52 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'Wof' (10.0, ?1988?-?11?-?15T10:06:29.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:52.096425700Z" />
    <EventRecordID>372</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">3</Data>
    <Data Name="DeviceName">Wof</Data>
    <Data Name="DeviceTime">1988-11-15T10:06:29.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          15/11/2018 7:16:52 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'FileInfo' (10.0, ?1981?-?05?-?09T10:40:31.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:52.095693700Z" />
    <EventRecordID>371</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">10</Data>
    <Data Name="DeviceVersionMinor">0</Data>
    <Data Name="DeviceNameLength">8</Data>
    <Data Name="DeviceName">FileInfo</Data>
    <Data Name="DeviceTime">1981-05-09T10:40:31.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:16:51 PM
Event ID:      20
Task Category: (6)
Level:         Information
Keywords:      Time
User:          SYSTEM
Computer:      user-PC
Description:
The description for Event ID 20 from source Microsoft-Windows-Kernel-General cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

0
True
0
0

the message resource is present but the message is not found in the string/message table

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>20</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>6</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.714316500Z" />
    <EventRecordID>370</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="UpdateReason">0</Data>
    <Data Name="EnabledNew">true</Data>
    <Data Name="CountNew">0</Data>
    <Data Name="CountOld">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 7:16:51 PM
Event ID:      32
Task Category: (58)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The bootmgr spent 0 ms waiting for user input.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>32</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>58</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712455400Z" />
    <EventRecordID>369</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="BitlockerUserInputTime">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 7:16:51 PM
Event ID:      18
Task Category: (57)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
There are 0x1 boot options on this system.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>18</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>57</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712430400Z" />
    <EventRecordID>368</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="EntryCount">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 7:16:51 PM
Event ID:      27
Task Category: (33)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The boot type was 0x0.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>27</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>33</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712373100Z" />
    <EventRecordID>367</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="BootType">0</Data>
    <Data Name="LoadOptions"> NOEXECUTE=OPTIN</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 7:16:51 PM
Event ID:      25
Task Category: (32)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The boot menu policy was 0x1.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>25</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>32</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712372800Z" />
    <EventRecordID>366</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="BootMenuPolicy">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 7:16:51 PM
Event ID:      20
Task Category: (31)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The last shutdown's success status was true. The last boot's success status was true.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>20</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>31</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712319000Z" />
    <EventRecordID>365</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="LastShutdownGood">true</Data>
    <Data Name="LastBootGood">true</Data>
    <Data Name="LastBootId">2</Data>
    <Data Name="BootStatusPolicy">2</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 7:16:51 PM
Event ID:      153
Task Category: (62)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Virtualization-based security (policies: 0) is disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>153</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>62</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712218500Z" />
    <EventRecordID>364</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Status">0</Data>
    <Data Name="EnableDisableReason">0</Data>
    <Data Name="VsmPolicy">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:16:51 PM
Event ID:      12
Task Category: (1)
Level:         Information
Keywords:      (128)
User:          SYSTEM
Computer:      user-PC
Description:
The operating system started at system time ?2018?-?11?-?15T08:46:51.500000000Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:51.712152200Z" />
    <EventRecordID>363</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="MajorVersion">10</Data>
    <Data Name="MinorVersion">0</Data>
    <Data Name="BuildVersion">17763</Data>
    <Data Name="QfeVersion">107</Data>
    <Data Name="ServiceVersion">0</Data>
    <Data Name="BootMode">0</Data>
    <Data Name="StartTime">2018-11-15T08:46:51.500000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 7:16:36 PM
Event ID:      13
Task Category: (2)
Level:         Information
Keywords:      (128)
User:          N/A
Computer:      user-PC
Description:
The operating system is shutting down at system time ?2018?-?11?-?15T08:46:36.532950600Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>13</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>2</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:36.532951700Z" />
    <EventRecordID>362</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="6788" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="StopTime">2018-11-15T08:46:36.532950600Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          15/11/2018 7:16:29 PM
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (70368744177664),(1024),(4)
User:          N/A
Computer:      user-PC
Description:
The kernel power manager has initiated a shutdown transition.

Shutdown Reason: Kernel API
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>109</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>103</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000400000000404</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:29.923196900Z" />
    <EventRecordID>361</EventRecordID>
    <Correlation />
    <Execution ProcessID="576" ThreadID="580" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ShutdownActionType">5</Data>
    <Data Name="ShutdownEventCode">0</Data>
    <Data Name="ShutdownReason">5</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WLAN-AutoConfig
Date:          15/11/2018 7:16:28 PM
Event ID:      4001
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
WLAN AutoConfig service has successfully stopped.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
    <EventID>4001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>2</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:28.698761300Z" />
    <EventRecordID>360</EventRecordID>
    <Correlation />
    <Execution ProcessID="2464" ThreadID="4816" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          15/11/2018 7:17:09 PM
Event ID:      6013
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The system uptime is 17 seconds.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6013</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:09.116396100Z" />
    <EventRecordID>359</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>17</Data>
    <Data>0</Data>
    <Data>-570 Cen. Australia Standard Time</Data>
    <Binary>31002E003100000030000000570069006E0064006F00770073002000310030002000500072006F000000310030002E0030002E003100370037003600330020004200750069006C0064002000310037003700360033002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000310037003700360033002E007200730035005F00720065006C0065006100730065002E003100380030003900310034002D00310034003300340000003500620065006300320064006300390000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C0065000000390000003400000033003900380035000000630030003900000075007300650072002D005000430000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          15/11/2018 7:17:09 PM
Event ID:      6005
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Event log service was started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6005</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:09.116396100Z" />
    <EventRecordID>358</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>E2070B0004000F0008002F00090074000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          15/11/2018 7:17:09 PM
Event ID:      6009
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Microsoft (R) Windows (R) 10.00. 17763  Multiprocessor Free.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:47:09.116396100Z" />
    <EventRecordID>357</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>10.00.</Data>
    <Data>17763</Data>
    <Data>
    </Data>
    <Data>Multiprocessor Free</Data>
    <Data>0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          15/11/2018 7:16:24 PM
Event ID:      50037
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 client service is stopped. ShutDown Flag value is 1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50037</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>69</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:24.269711700Z" />
    <EventRecordID>356</EventRecordID>
    <Correlation />
    <Execution ProcessID="1600" ThreadID="1620" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="DwordVal">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          15/11/2018 7:16:24 PM
Event ID:      50106
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 is waiting on DHCPv6 service to stop
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50106</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>129</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:24.269682600Z" />
    <EventRecordID>355</EventRecordID>
    <Correlation />
    <Execution ProcessID="1600" ThreadID="1620" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCPv6-Client
Date:          15/11/2018 7:16:24 PM
Event ID:      51057
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
    <EventID>51057</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>104</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:24.267174600Z" />
    <EventRecordID>354</EventRecordID>
    <Correlation />
    <Execution ProcessID="1600" ThreadID="1640" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="DwordVal">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCPv6-Client
Date:          15/11/2018 7:16:24 PM
Event ID:      51047
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv6 client service is stopped. ShutDown Flag value is 1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
    <EventID>51047</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>63</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:24.267171900Z" />
    <EventRecordID>353</EventRecordID>
    <Correlation />
    <Execution ProcessID="1600" ThreadID="1640" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="DwordVal">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          15/11/2018 7:16:26 PM
Event ID:      6006
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Event log service was stopped.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6006</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:26.755851100Z" />
    <EventRecordID>352</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>0100000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          15/11/2018 7:16:24 PM
Event ID:      50105
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50105</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>129</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:24.254695400Z" />
    <EventRecordID>351</EventRecordID>
    <Correlation />
    <Execution ProcessID="1600" ThreadID="1620" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          15/11/2018 7:16:24 PM
Event ID:      50104
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 client received shutdown notification
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50104</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>129</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:24.254520000Z" />
    <EventRecordID>350</EventRecordID>
    <Correlation />
    <Execution ProcessID="1600" ThreadID="1604" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          15/11/2018 7:16:22 PM
Event ID:      7002
Task Category: (1102)
Level:         Information
Keywords:      (35184372088832)
User:          SYSTEM
Computer:      user-PC
Description:
User Logoff Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1102</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000200000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:46:22.946447500Z" />
    <EventRecordID>349</EventRecordID>
    <Correlation />
    <Execution ProcessID="7600" ThreadID="8816" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">2</Data>
    <Data Name="UserSid">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
  </EventData>
</Event>

Log Name:      System
Source:        BROWSER
Date:          15/11/2018 7:13:02 PM
Event ID:      8032
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}. The backup browser is stopping.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="49152">8032</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:43:02.617409600Z" />
    <EventRecordID>348</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}</Data>
    <Binary>88080000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        BROWSER
Date:          15/11/2018 7:12:01 PM
Event ID:      8021
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The browser service was unable to retrieve a list of servers from the browser master \\IMAGER on the network \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}.
 
 Browser master: \\IMAGER
 Network: \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}
 
 This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="32768">8021</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:42:01.539209400Z" />
    <EventRecordID>347</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\IMAGER</Data>
    <Data>\Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}</Data>
    <Binary>88080000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          15/11/2018 6:54:48 PM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          S-1-5-21-1074371277-1214576197-998651128-1000
Computer:      user-PC
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user user-PC\user SID (S-1-5-21-1074371277-1214576197-998651128-1000) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:24:48.063617800Z" />
    <EventRecordID>346</EventRecordID>
    <Correlation />
    <Execution ProcessID="8" ThreadID="8812" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
    <Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
    <Data Name="param6">user-PC</Data>
    <Data Name="param7">user</Data>
    <Data Name="param8">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:50:27 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
A service was installed in the system.

Service Name:  MpKsl60550205
Service File Name:  C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpKsl60550205.sys
Service Type:  kernel mode driver
Service Start Type:  system start
Service Account:  
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:20:27.815932800Z" />
    <EventRecordID>345</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="628" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ServiceName">MpKsl60550205</Data>
    <Data Name="ImagePath">C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpKsl60550205.sys</Data>
    <Data Name="ServiceType">kernel mode driver</Data>
    <Data Name="StartType">system start</Data>
    <Data Name="AccountName">
    </Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:43:12 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:13:12.495462900Z" />
    <EventRecordID>344</EventRecordID>
    <Correlation />
    <Execution ProcessID="7956" ThreadID="6724" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">95</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:43:11 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:13:11.254223600Z" />
    <EventRecordID>343</EventRecordID>
    <Correlation />
    <Execution ProcessID="5464" ThreadID="7836" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">100</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:42:29 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:12:29.806562600Z" />
    <EventRecordID>342</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="4108" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">BITS</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:37:37 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Windows Modules Installer service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:07:37.273253600Z" />
    <EventRecordID>341</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="4724" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          15/11/2018 6:37:02 PM
Event ID:      44
Task Category: Windows Update Agent
Level:         Information
Keywords:      Download,Download
User:          SYSTEM
Computer:      user-PC
Description:
Windows Update started downloading an update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>44</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002004</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:07:02.742845000Z" />
    <EventRecordID>340</EventRecordID>
    <Correlation />
    <Execution ProcessID="4056" ThreadID="1452" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="updateTitle">2018-10 Cumulative Update for Windows 10 Version 1809 for x64-based Systems (KB4464455)</Data>
    <Data Name="updateGuid">{1684CB04-4D24-4624-9C90-C26EA45750A8}</Data>
    <Data Name="updateRevisionNumber">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:36:46 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Windows Modules Installer service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:06:46.536412200Z" />
    <EventRecordID>339</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="4724" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:34:00 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\WINDOWS\AppCompat\Programs\Amcache.hve.tmp was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:04:00.649003500Z" />
    <EventRecordID>338</EventRecordID>
    <Correlation />
    <Execution ProcessID="908" ThreadID="4888" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">49</Data>
    <Data Name="HiveName">\??\C:\WINDOWS\AppCompat\Programs\Amcache.hve.tmp</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:33:38 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
A service was installed in the system.

Service Name:  MediaPortal 2 Server Service
Service File Name:  "C:\Program Files (x86)\Team MediaPortal\MP2-Server\MP2-Server.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T08:03:38.983257900Z" />
    <EventRecordID>337</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="7348" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ServiceName">MediaPortal 2 Server Service</Data>
    <Data Name="ImagePath">"C:\Program Files (x86)\Team MediaPortal\MP2-Server\MP2-Server.exe"</Data>
    <Data Name="ServiceType">user mode service</Data>
    <Data Name="StartType">auto start</Data>
    <Data Name="AccountName">LocalSystem</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:27:28 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:57:28.089261000Z" />
    <EventRecordID>336</EventRecordID>
    <Correlation />
    <Execution ProcessID="6128" ThreadID="8624" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">98</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:27:01 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:57:01.735625200Z" />
    <EventRecordID>335</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="2504" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">BITS</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:26:44 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:56:44.463574200Z" />
    <EventRecordID>334</EventRecordID>
    <Correlation />
    <Execution ProcessID="8960" ThreadID="3860" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">97</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          15/11/2018 6:25:50 PM
Event ID:      98
Task Category: None
Level:         Information
Keywords:      (2)
User:          SYSTEM
Computer:      user-PC
Description:
Volume ?? (\Device\HarddiskVolumeShadowCopy1) is healthy.  No action is needed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}" />
    <EventID>98</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:55:50.282669800Z" />
    <EventRecordID>333</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="192" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">??</Data>
    <Data Name="DeviceName">\Device\HarddiskVolumeShadowCopy1</Data>
    <Data Name="CorruptionActionState">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:25:27 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:55:27.626872400Z" />
    <EventRecordID>332</EventRecordID>
    <Correlation />
    <Execution ProcessID="8516" ThreadID="2612" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">94</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          15/11/2018 6:24:54 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:54:54.906871100Z" />
    <EventRecordID>331</EventRecordID>
    <Correlation />
    <Execution ProcessID="696" ThreadID="4116" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">BITS</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:22:24 PM
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The access history in hive \??\C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:52:24.759948500Z" />
    <EventRecordID>330</EventRecordID>
    <Correlation />
    <Execution ProcessID="1144" ThreadID="8464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">94</Data>
    <Data Name="HiveName">\??\C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat</Data>
    <Data Name="KeysUpdated">3</Data>
    <Data Name="DirtyPages">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Power-Troubleshooter
Date:          15/11/2018 6:21:39 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
The system has returned from a low power state.

Sleep Time: ?2018?-?11?-?14T14:33:09.456695600Z
Wake Time: ?2018?-?11?-?15T07:51:38.166523200Z

Wake Source: Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{CDC05E28-C449-49C6-B9D2-88CF761644DF}" />
    <EventID>1</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:39.597503900Z" />
    <EventRecordID>329</EventRecordID>
    <Correlation ActivityID="{21B37D0F-0DA4-4472-8BB0-E831006F7F3A}" />
    <Execution ProcessID="2996" ThreadID="8904" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="SleepTime">2018-11-14T14:33:09.456695600Z</Data>
    <Data Name="WakeTime">2018-11-15T07:51:38.166523200Z</Data>
    <Data Name="SleepDuration">4241</Data>
    <Data Name="WakeDuration">2504</Data>
    <Data Name="DriverInitDuration">1505</Data>
    <Data Name="BiosInitDuration">0</Data>
    <Data Name="HiberWriteDuration">3826</Data>
    <Data Name="HiberReadDuration">4040</Data>
    <Data Name="HiberPagesWritten">134723</Data>
    <Data Name="Attributes">1912619265</Data>
    <Data Name="TargetState">6</Data>
    <Data Name="EffectiveState">5</Data>
    <Data Name="WakeSourceType">0</Data>
    <Data Name="WakeSourceTextLength">0</Data>
    <Data Name="WakeSourceText">
    </Data>
    <Data Name="WakeTimerOwnerLength">0</Data>
    <Data Name="WakeTimerContextLength">0</Data>
    <Data Name="NoMultiStageResumeReason">0</Data>
    <Data Name="WakeTimerOwner">
    </Data>
    <Data Name="WakeTimerContext">
    </Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          15/11/2018 6:21:39 PM
Event ID:      7001
Task Category: (1101)
Level:         Information
Keywords:      (35184372088832)
User:          SYSTEM
Computer:      user-PC
Description:
User Logon Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000200000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:39.386153600Z" />
    <EventRecordID>328</EventRecordID>
    <Correlation />
    <Execution ProcessID="7600" ThreadID="8816" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">2</Data>
    <Data Name="UserSid">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 6:21:37 PM
Event ID:      32
Task Category: (58)
Level:         Information
Keywords:      
User:          N/A
Computer:      user-PC
Description:
The bootmgr spent 0 ms waiting for user input.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>32</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>58</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:37.100344900Z" />
    <EventRecordID>327</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="BitlockerUserInputTime">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 6:21:37 PM
Event ID:      18
Task Category: (57)
Level:         Information
Keywords:      
User:          N/A
Computer:      user-PC
Description:
There are 0x1 boot options on this system.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>18</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>57</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:37.100262000Z" />
    <EventRecordID>326</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="EntryCount">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 6:21:37 PM
Event ID:      27
Task Category: (33)
Level:         Information
Keywords:      
User:          N/A
Computer:      user-PC
Description:
The boot type was 0x1.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>27</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>33</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:37.100206900Z" />
    <EventRecordID>325</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="BootType">1</Data>
    <Data Name="LoadOptions">
    </Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Boot
Date:          15/11/2018 6:21:37 PM
Event ID:      25
Task Category: (32)
Level:         Information
Keywords:      
User:          N/A
Computer:      user-PC
Description:
The boot menu policy was 0x1.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
    <EventID>25</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>32</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:37.100206700Z" />
    <EventRecordID>324</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="BootMenuPolicy">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        e1cexpress
Date:          15/11/2018 6:21:35 PM
Event ID:      27
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 27 from source e1cexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

Intel(R) 82579LM Gigabit Network Connection

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="e1cexpress" />
    <EventID Qualifiers="40964">27</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:35.912226200Z" />
    <EventRecordID>323</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>Intel(R) 82579LM Gigabit Network Connection</Data>
    <Binary>0000040002003000000000001B0004A00000000000000000000000000000000000000000000000001B0004A0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          15/11/2018 6:21:35 PM
Event ID:      1
Task Category: (5)
Level:         Information
Keywords:      Time
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 1 from source Microsoft-Windows-Kernel-General cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

15/11/2018 7:51:35 AM
14/11/2018 2:33:14 PM
2
4

the message resource is present but the message is not found in the string/message table

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>1</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>5</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:35.500156500Z" />
    <EventRecordID>322</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="NewTime">2018-11-15T07:51:35.500000000Z</Data>
    <Data Name="OldTime">2018-11-14T14:33:14.218470400Z</Data>
    <Data Name="Reason">2</Data>
    <Data Name="ProcessName">
    </Data>
    <Data Name="ProcessID">4</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          15/11/2018 1:03:14 AM
Event ID:      107
Task Category: (102)
Level:         Information
Keywords:      (1024),(64),(4)
User:          N/A
Computer:      user-PC
Description:
The system has resumed from sleep.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>107</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>102</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000444</Keywords>
    <TimeCreated SystemTime="2018-11-14T14:33:14.218511500Z" />
    <EventRecordID>321</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="124" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetState">6</Data>
    <Data Name="EffectiveState">5</Data>
    <Data Name="WakeFromState">5</Data>
    <Data Name="ProgrammedWakeTimeAc">1601-01-01T00:00:00.000000000Z</Data>
    <Data Name="ProgrammedWakeTimeDc">1601-01-01T00:00:00.000000000Z</Data>
    <Data Name="WakeRequesterTypeAc">0</Data>
    <Data Name="WakeRequesterTypeDc">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          15/11/2018 6:21:35 PM
Event ID:      6013
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The system uptime is 63753 seconds.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6013</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-15T07:51:35.718670000Z" />
    <EventRecordID>320</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>63753</Data>
    <Data>0</Data>
    <Data>-570 Cen. Australia Standard Time</Data>
    <Binary>31002E003100000030000000570069006E0064006F00770073002000310030002000500072006F000000310030002E0030002E003100370037003600330020004200750069006C0064002000310037003700360033002000200000004D0075006C0074006900700072006F0063006500730073006F007200200046007200650065000000310037003700360033002E007200730035005F00720065006C0065006100730065002E003100380030003900310034002D00310034003300340000003500620065006300320063003600360000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C0065000000390000003400000033003900380035000000630030003900000075007300650072002D005000430000000000</Binary>
  </EventData>
</Event>