ElfFilejElfChnkȰn3</T00P @ %2</Opcode><Keywords>%6</Keywords><TimeCreated SystemTime='%7'/><EventRecordID> %11 </EventRecordID><Correlation ActivityID='%8' RelatedActivityID='%19'/><Execution ProcessID='%9' ThreadID='%10' /><Channel>Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc</Channel><Computer>WIN-ENDMUL1S4P6</Computer><Security UserID='%13'/></System>%20</Event>yx<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Crypto-DPAPI' Guid='{89fe8f40-cdce-464e-8217-15ef97d4c7c3}' /><EventID Qualifiers='%5'>%4</EventID><Version>%12</Version><Level>%1</Level><Task>%3</Task><Opcode>%2</Opcode><Keywords>%6</Keywords><TimeCreated SystemTime='%7'/><EventRecordID> %11 </EventRecordID><Correlation ActivityID='%8' RelatedActivityID='%19'/><Execution ProcessID='%9' ThreadID='%10' /><Channel>Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc</Channel><Computer>WIN-ENDMUL1S4P6</Computer><Security UserID='%13'/></System><UserData>%20</UserData></Event>D5RelatedActivityIDAU Execution8F ProcessID9ThreadID aChannel+P J jjP J ventxmlns5http://schemas.microsoft.com/win/2004/08/events/eventosoTSystemA{ProviderFKNameMicrosoft-Windows-Crypto-DPAPI)Guid&{89fe8f40-cdce-464e-8217-15ef97d4c7c3}A=aEventID) Qualifiers  Version dLevelE{TaskOpcodejKeywordsA@; TimeCreated<{ SystemTime &F EventRecordID Am CorrelationLF ActivityID5RelatedActivityIDAU Execution8F ProcessID9ThreadID aChannel+)) J  ` ` P