{"EventCode": "7045", "EventData_Xml": "<Data Name='ServiceName'>Bluetooth Service</Data><Data Name='ImagePath'>C:\\Users\\Administrator\\AppData\\Roaming\\Bluetooth\\BluetoothService.exe</Data><Data Name='ServiceType'>user mode service</Data><Data Name='StartType'>demand start</Data><Data Name='AccountName'>LocalSystem</Data>", "ServiceName": "Bluetooth Service", "System_Props_Xml": "<Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7045</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2026-02-02T20:32:53.6082405Z'/><EventRecordID>135798</EventRecordID><Correlation/><Execution ProcessID='652' ThreadID='8572'/><Channel>System</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security UserID='S-1-5-21-176355122-716717498-2264044224-500'/>", "_bkt": "win~0~84569963-7203-40C6-84C0-B281193711B0", "_cd": "0:120274487", "_indextime": "1770064374", "_raw": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7045</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2026-02-02T20:32:53.6082405Z'/><EventRecordID>135798</EventRecordID><Correlation/><Execution ProcessID='652' ThreadID='8572'/><Channel>System</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security UserID='S-1-5-21-176355122-716717498-2264044224-500'/></System><EventData><Data Name='ServiceName'>Bluetooth Service</Data><Data Name='ImagePath'>C:\\Users\\Administrator\\AppData\\Roaming\\Bluetooth\\BluetoothService.exe</Data><Data Name='ServiceType'>user mode service</Data><Data Name='StartType'>demand start</Data><Data Name='AccountName'>LocalSystem</Data></EventData></Event>", "_serial": "0", "_si": ["splunk-server", "win"], "_sourcetype": "XmlWinEventLog", "_time": "2026-02-02T20:32:53.000+00:00", "host": "AR-WIN-DC", "index": "win", "linecount": "1", "source": "XmlWinEventLog:System", "sourcetype": "XmlWinEventLog", "splunk_server": "splunk-server"}