- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Execution Service" /> 
  <EventID Qualifiers="0">1</EventID> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2019-06-09T11:26:26.000000000Z" /> 
  <EventRecordID>3474205</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>User-PC</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>Watched process exited with code 10</Data> 
  </EventData>
  </Event>