<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="Microsoft-Windows-Sysmon" Guid="{guid}" />
        <EventID>1</EventID>
        <Version>5</Version>
        <Level>4</Level>
        <Task>1</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="{timestamp}" />
        <EventRecordID>9947</EventRecordID>
        <Correlation />
        <Execution ProcessID="{process_id}" ThreadID="{thread_id}" />
        <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
        <Computer>{computer_name}</Computer>
        <Security UserID="S-1-5-18" />
    </System>
    <EventData>
        <Data Name="UtcTime">{timestamp}</Data>
        <Data Name="ProcessGuid">{guid}</Data>
        <Data Name="ProcessId">{process_id}</Data>
        <Data Name="Image">{image_path}</Data>
        <Data Name="CommandLine">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --lang=en-US --no-sandbox --service-request-channel-token=F47498BBA884E523FA93E623C4569B94 --mojo-platform-channel-handle=3432 /prefetch:8</Data>
        <Data Name="CurrentDirectory">{current_directory}</Data>
        <Data Name="User">{domain}\{user}</Data>
        <Data Name="LogonGuid">{{logon_guid}}</Data>
        <Data Name="LogonId">0x7eb05</Data>
        <Data Name="TerminalSessionId">1</Data>
        <Data Name="IntegrityLevel">{integrity_level}</Data>
        <Data Name="Hashes">SHA256={sha256}</Data>
        <Data Name="ParentProcessGuid">{guid}</Data>
        <Data Name="ParentProcessId">{process_id}</Data>
        <Data Name="ParentImage">{image_path}</Data>
        <Data Name="ParentCommandLine">"{image_path}"</Data>
    </EventData>
</Event>