<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">;
<System>
<Provider Name="User32" Guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" EventSourceName="User32" />
<EventID Qualifiers="32768">1074</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2021-09-16T04:54:03.1068169Z" />
<EventRecordID>8850</EventRecordID>
<Correlation />
<Execution ProcessID="700" ThreadID="1692" />
<Channel>System</Channel>
<Computer>DESKTOP-V4NB1NI</Computer>
<Security UserID="S-1-5-18" />
</System><EventData>
<Data Name="param1">C:\WINDOWS\system32\svchost.exe (DESKTOP-V4NB1NI)</Data>
<Data Name="param2">DESKTOP-V4NB1NI</Data>
<Data Name="param3">操作系统: Service Pack (计划内)</Data>
<Data Name="param4">0x80020010</Data>
<Data Name="param5">重启</Data>
<Data Name="param6" />
<Data Name="param7">NT AUTHORITY\SYSTEM</Data>
</EventData>
</Event>