Lightrun
question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

xpath parsing error

See original GitHub issue
Author: Hyun Yi @hyuunnn
Description: A program was installed.
EventId: 1033
Channel: "Application"
Provider: "MsiInstaller"
Maps:
  -
    Property: PayloadData1
    PropertyValue: "Name: %Name%"
    Values:
      -
        Name: Name
        Value: "/Event/EventData/Data[1]"
  -
    Property: PayloadData2
    PropertyValue: "Version: %Version%"
    Values:
      -
        Name: Version
        Value: "/Event/EventData/Data[2]"
  -
    Property: PayloadData3
    PropertyValue: "Lang: %Lang%"
    Values:
      -
        Name: Lang
        Value: "/Event/EventData/Data[3]"
  -
    Property: PayloadData4
    PropertyValue: "Status: %Status%"
    Values:
      -
        Name: Status
        Value: "/Event/EventData/Data[4]"
  -
    Property: PayloadData5
    PropertyValue: "Manufacturer: %Manufacturer%"
    Values:
      -
        Name: Manufacturer
        Value: "/Event/EventData/Data[5]"

# Valid properties include:

# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
#   <System>
#     <Provider Name="MsiInstaller" /> 
#     <EventID Qualifiers="0">1033</EventID> 
#     <Version>0</Version> 
#     <Level>4</Level> 
#     <Task>0</Task> 
#     <Opcode>0</Opcode> 
#     <Keywords>0x80000000000000</Keywords> 
#     <TimeCreated SystemTime="2020-11-29T19:30:51.7375522Z" /> 
#     <EventRecordID>18388</EventRecordID> 
#     <Correlation /> 
#     <Execution ProcessID="0" ThreadID="0" /> 
#     <Channel>Application</Channel> 
#     <Computer>ComputerName</Computer> 
#     <Security UserID="{UserID}" /> 
#   </System>
#   <EventData>
#     <Data>Python 3.9.0 Utility Scripts (64-bit)</Data> 
#     <Data>3.9.150.0</Data> 
#     <Data>1033</Data> 
#     <Data>0</Data> 
#     <Data>Python Software Foundation</Data> 
#     <Data>(NULL)</Data> 
#     <Data /> 
#     <Binary>{Binary}</Binary> 
#   </EventData>
# </Event>

This is my map file.

0 but all data were saved in PayloadData1.

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:9 (9 by maintainers)

github_iconTop GitHub Comments

1reaction
EricZimmermancommented, Dec 3, 2020

There is not a single example of data in that evtx file that has more than 1 data element.

There is nothing wrong with the map you are using. its telling you the elements you are trying to reference are not there, and its 100% correct.

do this EvtxECmd.exe -f C:\Temp\A2.evtx --xml .

then look at the XML.

it cannot find elements in the xml that arent there.

there is nothing else i can do here, so closing for now. if you do find an issue, please comment again

here is the data, regexed out to just show the eventdata stuff

<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729, 9.0.30729, 1042, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-38-38-37-38-36-38-41-32-2D-44-36-44-45-2D-33-32-35-35-2D-41-41-39-32-2D-41-41-30-42-35-41-35-39-42-38-37-34-7D-30-30-30-30-33-38-34-39-61-65-62-32-30-61-63-62-33-34-34-38-39-33-39-32-66-35-33-66-37-62-65-64-30-35-63-35-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17, 9.0.30729, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-38-32-32-30-45-45-46-45-2D-33-38-43-44-2D-33-37-37-45-2D-38-35-39-35-2D-31-33-33-39-38-44-37-34-30-41-43-45-7D-30-30-30-30-31-63-37-31-62-31-33-38-30-62-31-32-33-64-65-34-33-34-37-64-64-30-31-34-65-35-36-35-33-36-38-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030, 11.0.61030, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-43-46-32-42-45-41-33-43-2D-32-36-45-41-2D-33-32-46-38-2D-41-41-39-42-2D-33-33-31-46-37-45-33-34-42-41-39-37-7D-30-30-30-30-63-30-34-66-36-36-63-34-39-33-38-32-66-37-34-30-36-64-30-34-39-65-38-64-65-31-61-37-64-33-39-31-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030, 11.0.61030, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-33-37-42-38-46-39-43-37-2D-30-33-46-42-2D-33-32-35-33-2D-38-37-38-31-2D-32-35-31-37-43-39-39-44-37-43-30-30-7D-30-30-30-30-35-63-34-32-63-61-64-37-62-38-65-30-35-62-32-61-30-37-37-66-35-66-61-61-61-37-62-30-33-64-36-39-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005, 12.0.21005, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-46-38-43-46-45-42-32-32-2D-41-32-45-37-2D-33-39-37-31-2D-39-45-44-41-2D-34-42-31-31-45-44-45-46-43-31-38-35-7D-30-30-30-30-65-39-35-32-65-31-30-33-33-62-36-30-62-39-36-34-33-30-66-32-35-35-62-65-61-63-66-35-61-65-32-38-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005, 12.0.21005, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-31-33-41-34-45-45-31-32-2D-32-33-45-41-2D-33-33-37-31-2D-39-31-45-45-2D-45-46-42-33-36-44-44-46-46-46-33-45-7D-30-30-30-30-30-39-32-31-38-66-31-64-64-33-62-30-33-37-64-38-32-35-30-64-36-39-36-64-63-66-33-32-31-34-31-63-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AccessData FTK Imager, 4.5.0.3, 1033, 1602, AccessData, (NULL)</Data>
    <Binary>7B-36-35-38-30-38-31-45-41-2D-45-38-46-45-2D-34-45-39-37-2D-41-46-38-35-2D-41-46-35-46-39-45-30-41-37-38-34-38-7D-30-30-30-30-63-37-38-30-30-36-62-39-31-30-62-37-37-63-31-38-38-33-33-33-34-64-38-36-39-61-61-36-38-35-33-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AccessData FTK Imager, 4.5.0.3, 1033, 1602, AccessData, (NULL)</Data>
    <Binary>7B-36-35-38-30-38-31-45-41-2D-45-38-46-45-2D-34-45-39-37-2D-41-46-38-35-2D-41-46-35-46-39-45-30-41-37-38-34-38-7D-30-30-30-30-63-37-38-30-30-36-62-39-31-30-62-37-37-63-31-38-38-33-33-33-34-64-38-36-39-61-61-36-38-35-33-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AccessData FTK Imager, 4.5.0.3, 1033, 0, AccessData, (NULL)</Data>
    <Binary>7B-36-35-38-30-38-31-45-41-2D-45-38-46-45-2D-34-45-39-37-2D-41-46-38-35-2D-41-46-35-46-39-45-30-41-37-38-34-38-7D-30-30-30-30-63-37-38-30-30-36-62-39-31-30-62-37-37-63-31-38-38-33-33-33-34-64-38-36-39-61-61-36-38-35-33-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>FileInsight, 3.0, 1033, 0, McAfee LLC, (NULL)</Data>
    <Binary>7B-36-32-44-46-45-42-32-41-2D-41-38-44-42-2D-34-38-43-33-2D-42-45-46-32-2D-41-32-34-39-30-32-33-39-41-36-34-31-7D-30-30-30-30-61-62-61-32-38-64-64-31-62-65-66-63-39-30-65-35-62-30-63-62-65-35-35-62-35-32-64-30-63-30-35-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Java 8 Update 271 (64-bit), 8.0.2710.9, 1042, 0, Oracle Corporation, (NULL)</Data>
    <Binary>7B-32-36-41-32-34-41-45-34-2D-30-33-39-44-2D-34-43-41-34-2D-38-37-42-34-2D-32-46-36-34-31-38-30-32-37-31-46-30-7D-30-30-30-30-66-66-61-32-64-33-33-64-61-32-36-37-63-35-38-64-34-37-62-30-33-62-32-36-36-66-65-30-66-36-61-36-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>Java Auto Updater, 2.8.261.12, 1033, 0, Oracle Corporation, (NULL)</Data>
    <Binary>7B-34-41-30-33-37-30-36-46-2D-36-36-36-41-2D-34-30-33-37-2D-37-37-37-37-2D-35-46-32-37-34-38-37-36-34-44-31-30-7D-30-30-30-30-63-61-34-31-61-30-35-61-62-37-64-61-63-66-33-31-30-63-39-62-39-62-34-34-34-30-30-37-63-65-30-66-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Java Auto Updater, 2.8.271.9, 1033, 0, Oracle Corporation, (NULL)</Data>
    <Binary>7B-34-41-30-33-37-30-36-46-2D-36-36-36-41-2D-34-30-33-37-2D-37-37-37-37-2D-35-46-32-37-34-38-37-36-34-44-31-30-7D-30-30-30-30-64-64-32-32-65-33-35-33-34-35-64-37-35-39-36-37-35-37-63-63-63-66-34-34-39-66-33-63-65-32-37-61-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Java 8 Update 261 (64-bit), 8.0.2610.12, 1042, 0, Oracle Corporation, (NULL)</Data>
    <Binary>7B-32-36-41-32-34-41-45-34-2D-30-33-39-44-2D-34-43-41-34-2D-38-37-42-34-2D-32-46-36-34-31-38-30-32-36-31-46-30-7D-30-30-30-30-66-31-66-34-66-64-38-31-65-62-33-39-35-63-61-61-36-31-64-62-63-36-62-61-61-32-36-66-31-65-38-32-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319, 10.0.30319, 0, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-44-41-35-45-33-37-31-43-2D-36-33-33-33-2D-33-44-38-41-2D-39-33-41-34-2D-36-46-44-35-42-32-30-42-43-43-36-45-7D-30-30-30-30-37-36-35-37-34-34-36-34-33-39-33-61-35-39-39-32-35-34-30-65-32-36-30-63-35-61-33-37-62-36-37-39-30-30-30-30-30-30-30-30</Binary>
  </EventData>
<EventData>
    <Data>Apple ?? ???? ??(64??), 7.0.2, 1042, 0, Apple Inc., (NULL)</Data>
    <Binary>7B-30-43-42-38-34-41-37-44-2D-39-36-39-37-2D-34-35-32-36-2D-41-38-31-39-2D-36-30-46-42-30-35-30-45-38-46-30-35-7D-30-30-30-30-62-38-31-64-63-61-65-63-30-37-32-64-37-66-65-33-62-66-65-64-38-31-30-34-65-64-35-66-63-33-38-38-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>Apple Mobile Device Support, 12.0.0.1039, 1033, 0, Apple Inc., (NULL)</Data>
    <Binary>7B-37-37-46-38-43-38-37-39-2D-38-38-43-44-2D-34-31-34-35-2D-39-34-35-41-2D-35-34-31-43-33-35-32-38-35-32-38-35-7D-30-30-30-30-30-64-33-30-31-35-37-38-61-38-32-36-34-32-33-37-64-32-36-39-65-61-30-30-66-30-61-66-37-30-34-63-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Node.js, 0.12.2, 1033, 0, Joyent, Inc. and other Node contributors, (NULL)</Data>
    <Binary>7B-34-30-34-33-35-35-36-33-2D-32-30-42-30-2D-34-44-41-33-2D-38-45-35-32-2D-45-35-42-46-32-38-41-42-45-35-43-33-7D-30-30-30-30-63-35-37-34-30-61-38-36-61-61-31-34-64-31-32-62-38-66-64-30-61-65-62-32-35-39-64-34-63-62-35-38-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>CodeMeter Runtime Kit v6.50b, 6.50.2631.502, 1033, 0, WIBU-SYSTEMS AG, (NULL)</Data>
    <Binary>7B-43-41-30-37-30-45-45-31-2D-44-45-32-32-2D-34-46-39-43-2D-38-30-41-33-2D-32-32-38-31-39-38-32-43-45-46-30-31-7D-30-30-30-30-39-61-37-32-39-37-31-65-39-38-36-33-65-35-63-37-36-64-31-63-63-32-65-35-30-33-31-39-31-61-63-66-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2005 Redistributable, 8.0.56336, 0, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-37-32-39-39-30-35-32-62-2D-30-32-61-34-2D-34-36-32-37-2D-38-31-66-32-2D-31-38-31-38-64-61-35-64-35-35-30-64-7D-30-30-30-30-30-30-38-36-30-33-38-66-65-37-61-61-62-62-65-31-37-35-37-37-31-63-64-62-35-34-32-31-33-64-32-61-30-30-30-30-30-30-30-30</Binary>
  </EventData>
<EventData>
    <Data>AccessData Evidence Processing Engine 10.22, 10.22.0.4073, 1042, 0, AccessData, (NULL)</Data>
    <Binary>7B-30-39-30-38-35-39-41-46-2D-37-43-31-30-2D-34-36-37-41-2D-42-39-41-36-2D-45-46-39-46-35-45-42-31-43-38-46-31-7D-30-30-30-30-32-39-33-38-65-37-39-32-64-33-61-39-31-64-63-37-38-39-35-38-62-35-31-64-33-31-65-30-64-35-35-38-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>AccessData Forensic Toolkit (FTK) 7.2, 7.2.0.4147, 1042, 0, ???, (NULL)</Data>
    <Binary>7B-37-45-41-43-44-44-36-39-2D-33-31-43-37-2D-34-31-43-37-2D-39-34-36-37-2D-41-43-32-38-30-46-36-41-46-31-41-41-7D-30-30-30-30-36-30-39-30-66-30-37-36-36-62-39-65-34-39-30-35-66-33-32-37-63-61-63-61-63-32-38-30-36-34-65-66-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005, 12.0.21005, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-31-33-41-34-45-45-31-32-2D-32-33-45-41-2D-33-33-37-31-2D-39-31-45-45-2D-45-46-42-33-36-44-44-46-46-46-33-45-7D-30-30-30-30-30-39-32-31-38-66-31-64-64-33-62-30-33-37-64-38-32-35-30-64-36-39-36-64-63-66-33-32-31-34-31-63-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005, 12.0.21005, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-46-38-43-46-45-42-32-32-2D-41-32-45-37-2D-33-39-37-31-2D-39-45-44-41-2D-34-42-31-31-45-44-45-46-43-31-38-35-7D-30-30-30-30-65-39-35-32-65-31-30-33-33-62-36-30-62-39-36-34-33-30-66-32-35-35-62-65-61-63-66-35-61-65-32-38-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AccessData PostgreSQL, 11.2.0.10, 1033, 0, AccessData, (NULL)</Data>
    <Binary>7B-46-44-45-32-45-41-36-45-2D-41-45-34-41-2D-34-43-43-46-2D-41-46-35-44-2D-39-46-37-30-34-31-42-33-41-32-45-45-7D-30-30-30-30-39-35-35-35-31-61-61-61-65-38-61-62-62-33-38-64-37-63-63-36-32-36-63-37-62-37-62-65-34-61-61-39-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Sentinel Runtime, 7.100.31536.60000, 1033, 0, Gemalto, (NULL)</Data>
    <Binary>7B-30-37-33-42-44-39-41-46-2D-33-45-34-36-2D-34-39-34-31-2D-39-31-41-38-2D-37-45-45-32-32-44-45-30-32-34-32-35-7D-30-30-30-30-34-65-65-35-30-61-31-36-62-31-64-65-36-65-65-66-35-30-39-31-30-34-63-32-35-32-32-34-66-62-65-31-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Apple ?? ???? ??(64??), 7.6, 1042, 0, Apple Inc., (NULL)</Data>
    <Binary>7B-44-43-33-32-37-37-36-34-2D-41-31-42-31-2D-34-45-46-33-2D-41-30-37-43-2D-33-38-37-34-31-45-33-35-35-37-45-37-7D-30-30-30-30-31-39-64-36-36-63-32-64-65-31-66-34-39-61-32-35-30-33-30-30-62-35-32-31-31-65-66-37-38-39-37-34-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>Apple Mobile Device Support, 13.0.0.38, 1033, 0, Apple Inc., (NULL)</Data>
    <Binary>7B-36-43-45-43-46-30-46-42-2D-45-45-37-31-2D-34-46-45-35-2D-38-41-45-30-2D-46-41-30-30-37-34-30-38-39-33-34-41-7D-30-30-30-30-35-34-39-33-34-61-32-32-37-35-34-63-38-34-33-36-35-63-30-38-39-34-35-37-64-39-32-39-65-38-33-36-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft SQL Server 2005 Compact Edition [ENU], 3.1.0000, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-46-30-42-34-33-30-44-31-2D-42-36-41-41-2D-34-37-33-44-2D-39-42-30-36-2D-41-41-33-44-44-30-31-46-44-30-42-38-7D-30-30-30-30-62-30-30-30-39-36-31-31-62-34-38-38-33-39-37-34-35-39-66-37-61-66-63-64-34-34-65-33-62-64-34-64-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 0ff1ce15-a989-479d-af46-f275c6370663, 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 0ff1ce15-a989-479d-af46-f275c6370663, 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AccessData FTK Imager, 4.5.0.3, 1033, 0, AccessData, (NULL)</Data>
    <Binary>7B-36-35-38-30-38-31-45-41-2D-45-38-46-45-2D-34-45-39-37-2D-41-46-38-35-2D-41-46-35-46-39-45-30-41-37-38-34-38-7D-30-30-30-30-63-37-38-30-30-36-62-39-31-30-62-37-37-63-31-38-38-33-33-33-34-64-38-36-39-61-61-36-38-35-33-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AccessData FTK Imager, 4.5.0.3, 1033, 0, AccessData, (NULL)</Data>
    <Binary>7B-36-35-38-30-38-31-45-41-2D-45-38-46-45-2D-34-45-39-37-2D-41-46-38-35-2D-41-46-35-46-39-45-30-41-37-38-34-38-7D-30-30-30-30-63-37-38-30-30-36-62-39-31-30-62-37-37-63-31-38-38-33-33-33-34-64-38-36-39-61-61-36-38-35-33-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Splunk Enterprise, 8.0.5.0, 1033, 0, Splunk, Inc., (NULL)</Data>
    <Binary>7B-34-37-36-42-38-36-30-33-2D-39-45-36-33-2D-34-41-36-36-2D-42-42-42-39-2D-33-43-43-44-36-43-41-44-33-34-31-45-7D-30-30-30-30-38-62-34-37-66-39-63-33-33-63-66-62-36-61-64-31-65-36-34-62-36-33-32-30-33-30-31-34-64-36-37-64-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Message Analyzer, 4.0.8112.0, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-39-33-41-41-31-37-39-35-2D-39-37-34-42-2D-34-46-37-37-2D-41-34-39-38-2D-44-30-37-30-45-45-36-36-41-37-36-34-7D-30-30-30-30-62-65-62-66-33-62-31-36-31-33-34-35-33-38-62-39-34-35-62-64-39-66-61-33-37-39-33-37-37-62-36-64-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319, 10.0.30319, 0, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-31-39-36-42-42-34-30-44-2D-31-35-37-38-2D-33-44-30-31-2D-42-32-38-39-2D-42-45-46-43-37-37-41-31-31-41-31-45-7D-30-30-30-30-35-38-35-37-34-63-36-66-65-61-38-65-66-37-64-62-65-64-38-31-62-36-66-66-39-31-66-31-32-36-66-65-30-30-30-30-30-30-30-30</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17, 9.0.30729, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-39-41-32-35-33-30-32-44-2D-33-30-43-30-2D-33-39-44-39-2D-42-44-36-46-2D-32-31-45-36-45-43-31-36-30-34-37-35-7D-30-30-30-30-62-62-62-63-31-37-39-34-66-39-63-64-61-35-63-64-36-62-31-32-34-65-64-37-64-32-32-63-38-39-36-35-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>LibreOffice 7.0.3.1, 7.0.3.1, 1042, 0, The Document Foundation, (NULL)</Data>
    <Binary>7B-33-43-34-38-30-31-46-46-2D-33-44-37-42-2D-34-38-30-34-2D-38-37-37-45-2D-33-41-33-32-32-43-30-30-35-32-34-43-7D-30-30-30-30-34-62-31-64-65-32-30-64-37-36-31-35-38-39-62-32-65-34-32-35-61-66-31-37-38-33-65-32-64-31-32-65-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>????? ??, 9.6.1, 1042, 0, Hancom, (NULL)</Data>
    <Binary>7B-34-33-30-36-34-44-39-42-2D-45-30-42-33-2D-34-33-45-44-2D-41-31-43-36-2D-45-36-36-38-39-43-41-31-30-41-42-34-7D-30-30-30-30-63-62-64-63-33-37-30-34-31-34-32-62-31-63-31-61-37-35-31-64-36-39-37-37-36-62-30-39-32-33-61-38-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>EasyCrypt, 1.0.6, 1042, 0, http://copynull.tistory.com, (NULL)</Data>
    <Binary>7B-42-32-41-32-38-46-32-33-2D-35-36-42-44-2D-34-36-43-32-2D-38-45-33-39-2D-33-30-41-34-36-39-37-36-38-31-34-41-7D-30-30-30-30-39-31-64-64-35-30-36-35-35-64-33-34-34-61-62-33-66-31-32-32-36-34-61-36-39-33-39-38-36-30-65-65-30-30-30-30-31-32-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 0ff1ce15-a989-479d-af46-f275c6370663, 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Strawberry Perl (64-bit), 5.32.1, 1033, 0, strawberryperl.com project, (NULL)</Data>
    <Binary>7B-43-34-37-39-42-42-37-43-2D-36-43-34-30-2D-31-30-31-34-2D-41-44-33-44-2D-46-38-41-32-44-37-36-39-42-45-33-33-7D-30-30-30-30-65-33-36-65-37-64-38-65-61-61-31-31-32-37-38-30-34-36-36-34-32-61-35-36-37-35-30-31-32-65-33-62-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Enterprise Architect, 15.2.1554.40, 1033, 0, Sparx Systems, (NULL)</Data>
    <Binary>7B-41-32-43-39-33-32-42-30-2D-43-32-41-39-2D-34-37-46-46-2D-42-35-30-38-2D-36-45-38-37-31-31-33-36-33-36-43-36-7D-30-30-30-30-34-30-39-65-64-30-32-32-62-61-30-37-62-35-65-39-37-30-37-36-31-64-34-33-37-65-32-61-61-66-62-35-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Enterprise Architect, 15.2.1555.33, 1033, 0, Sparx Systems, (NULL)</Data>
    <Binary>7B-31-39-44-41-45-41-35-36-2D-33-32-34-45-2D-34-42-42-44-2D-41-37-42-30-2D-41-37-37-35-33-32-39-43-31-41-34-31-7D-30-30-30-30-65-31-63-62-61-63-61-32-61-62-30-63-62-36-39-63-39-63-61-66-32-37-32-33-33-33-61-39-30-33-32-32-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Registry Recon, 2.3.0.69, 1033, 0, Arsenal Recon, (NULL)</Data>
    <Binary>7B-43-34-41-45-33-45-33-43-2D-43-41-30-35-2D-34-32-38-41-2D-38-35-46-46-2D-31-45-46-37-30-43-36-39-33-34-45-43-7D-30-30-30-30-35-36-39-33-65-66-64-31-38-62-33-39-64-36-63-64-33-62-38-61-33-35-38-37-63-39-65-66-31-39-61-32-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148, 9.0.30729.4148, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-31-46-31-43-32-44-46-43-2D-32-44-32-34-2D-33-45-30-36-2D-42-43-42-38-2D-37-32-35-31-33-34-41-44-46-39-38-39-7D-30-30-30-30-61-62-64-31-66-36-36-30-63-61-63-62-33-31-34-64-37-32-66-64-64-39-38-30-63-31-37-36-32-63-63-32-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148, 9.0.30729.4148, 1033, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-34-42-36-43-37-30-30-31-2D-43-37-44-36-2D-33-37-31-30-2D-39-31-33-45-2D-35-42-43-32-33-46-43-45-39-31-45-36-7D-30-30-30-30-35-31-39-39-34-35-34-37-38-66-63-64-65-36-36-31-62-32-63-31-62-64-35-33-35-30-66-33-33-30-30-61-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>AAD-WindowsCore-AddAccountRestrictions, 100</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Security-SPP-WriteWauMarker, 500</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 55c92734-d682-4d71-983e-d6ec3f16059f, 8db63db6-4f8f-46d6-a448-66444faaaa72</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>(Security-SPP-Reserved-EnableNotificationMode) , 0ff1ce15-a989-479d-af46-f275c6370663, 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03</Data>
    <Binary></Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Core Interpreter (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-39-32-46-33-32-32-42-31-2D-44-36-39-41-2D-34-33-44-31-2D-38-32-42-34-2D-32-34-41-44-45-42-45-35-43-36-35-30-7D-30-30-30-30-31-61-63-66-30-64-35-30-38-61-31-32-32-36-30-30-65-66-37-62-37-32-65-37-35-62-39-34-62-39-65-62-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Development Libraries (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-45-37-33-46-45-31-39-32-2D-37-37-36-36-2D-34-39-46-41-2D-42-32-38-41-2D-33-32-46-37-30-30-44-39-38-41-31-35-7D-30-30-30-30-66-35-61-36-65-39-38-36-37-34-64-36-62-64-66-63-31-34-63-64-33-65-30-35-32-38-39-37-37-36-37-63-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Executables (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-41-39-46-37-31-38-42-41-2D-38-42-35-46-2D-34-41-45-37-2D-41-44-44-41-2D-45-46-46-46-34-33-31-39-34-38-44-42-7D-30-30-30-30-62-63-65-30-30-65-64-31-36-39-39-63-30-38-39-31-66-35-37-64-62-36-36-36-39-32-34-39-30-30-63-32-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Standard Library (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-34-32-34-38-30-45-45-35-2D-36-37-30-46-2D-34-41-46-33-2D-41-36-31-39-2D-32-45-37-36-31-41-33-39-38-33-34-30-7D-30-30-30-30-65-62-36-31-32-38-33-37-64-34-33-36-34-31-63-35-32-34-62-61-35-30-65-62-38-31-65-63-38-61-37-37-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Test Suite (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-39-31-34-31-45-39-39-30-2D-42-44-34-35-2D-34-46-34-32-2D-42-42-33-32-2D-42-33-30-31-32-39-36-39-33-35-35-44-7D-30-30-30-30-32-35-35-39-66-30-33-37-31-65-62-37-65-32-66-33-32-33-62-37-39-35-37-64-39-66-35-39-38-34-34-33-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Documentation (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-33-35-45-39-34-31-39-38-2D-42-39-46-31-2D-34-44-31-45-2D-41-38-36-39-2D-36-33-36-41-44-35-45-36-42-43-41-38-7D-30-30-30-30-38-34-34-32-65-66-62-37-33-65-62-30-63-63-39-35-36-33-61-64-64-30-39-33-65-37-62-32-31-64-32-64-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Utility Scripts (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-33-35-44-43-32-44-46-42-2D-30-41-45-41-2D-34-44-43-32-2D-41-46-41-35-2D-34-45-41-32-44-32-36-31-32-42-35-31-7D-30-30-30-30-37-64-39-63-35-36-62-63-63-36-39-64-30-66-32-39-61-39-31-30-61-33-61-31-36-63-36-39-62-34-63-37-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 Tcl/Tk Support (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-34-34-36-30-41-38-39-33-2D-45-46-46-36-2D-34-42-33-33-2D-42-46-32-31-2D-42-41-41-32-31-35-39-46-35-37-45-36-7D-30-30-30-30-31-65-61-39-37-65-38-64-63-35-62-61-61-65-61-38-33-63-62-34-30-38-36-64-30-31-37-34-33-32-65-65-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python Launcher, 3.9.7217.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-45-34-35-45-35-36-41-34-2D-46-43-44-44-2D-34-43-34-41-2D-39-36-36-41-2D-34-46-42-38-31-43-39-33-32-32-31-39-7D-30-30-30-30-36-39-36-65-63-32-34-63-37-36-37-32-39-36-39-63-63-65-61-31-63-63-66-62-34-38-64-35-35-32-34-63-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Python 3.9.0 pip Bootstrap (64-bit), 3.9.150.0, 1033, 0, Python Software Foundation, (NULL)</Data>
    <Binary>7B-32-37-46-46-30-39-44-38-2D-36-44-45-36-2D-34-46-36-33-2D-41-33-44-44-2D-38-37-35-38-44-36-31-35-44-35-34-33-7D-30-30-30-30-37-34-61-32-37-34-36-63-62-30-37-34-39-66-37-65-34-65-66-66-65-64-61-66-39-36-64-66-31-34-31-64-30-30-30-30-30-39-30-34</Binary>
  </EventData>
<EventData>
    <Data>Windows Subsystem for Linux Update, 4.19.128, 0, 0, Microsoft Corporation, (NULL)</Data>
    <Binary>7B-31-38-45-37-32-44-33-39-2D-33-39-32-43-2D-34-31-39-44-2D-39-42-38-36-2D-43-34-43-36-33-33-42-34-43-45-44-39-7D-30-30-30-30-64-38-63-62-63-63-66-30-36-62-33-32-39-61-63-32-65-36-64-33-31-35-35-32-62-37-38-35-64-34-37-63-30-30-30-30-30-30-30-30</Binary>
  </EventData>
<EventData>
    <Data>VMware Workstation, 16.1.0, 1033, 0, VMware, Inc., (NULL)</Data>
    <Binary>7B-46-38-33-38-41-39-38-41-2D-39-41-35-33-2D-34-39-38-33-2D-39-44-31-45-2D-31-33-34-45-43-37-35-37-41-31-36-32-7D-30-30-30-30-35-63-63-34-61-61-37-63-33-66-34-33-64-32-66-38-63-36-35-36-30-30-39-66-31-63-36-62-37-65-38-33-30-30-30-30-30-39-30-34</Binary>
  </EventData>
0reactions
hyuunnncommented, Dec 3, 2020

oh… Thank you so much 👍

Read more comments on GitHub >

github_iconTop Results From Across the Web

Error with XPath in a parsed XML document ...
I'm creating a Firefox for Android extension and I have a problem with a XML document retrieved from a XMLHttpRequest : I can't...
Read more >
Error parsing legal xpath · Issue #104 · goto100/xpath
It seems like adding a constraint to the parent selector causes a parsing error. This xpath does not throw and error: //text()[parent::*[true()]] ...
Read more >
"Unable to parse the if-then expression" with error "javax. ...
Cause. The reason for this error message is that the variable will hold an empty string and when performing the if-condition, the XPATH...
Read more >
google sheets - Formula Parse Error - unable to work out why
I assumed that I could just copy the XPath and add it to my URL, but it doesn't appear to be working. Any...
Read more >
Trying to parse xml with xpath - Power Platform Community
Solved: Hi, I'm fairly new to flow and I'm trying to parse the value ... language function 'xpath' failed to parse the provided...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found
Previous page

UTC vs local timestamp variances in tools

Next page

Error