[2026-04-03 10:04:09] EventID 4624 LogonType=2 User=alex.r
[2026-04-03 10:04:11] EventID 4688 NewProcess=WINWORD.EXE
[2026-04-03 10:04:24] EventID 4688 NewProcess=powershell.exe
[2026-04-03 10:05:02] EventID 4688 NewProcess=mshta.exe
[2026-04-03 10:06:40] EventID 4688 NewProcess=locker.exe
[2026-04-03 10:06:56] EventID 1102 The audit log was cleared