{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "System": {
      "Provider": {
        "#attributes": {
          "Name": "Microsoft-Windows-Windows Defender",
          "Guid": "11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78"
        }
      },
      "EventID": 1119,
      "Version": 0,
      "Level": 2,
      "Task": 0,
      "Opcode": 0,
      "Keywords": "0x8000000000000000",
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2026-04-17T04:14:33.653414Z"
        }
      },
      "EventRecordID": 542,
      "Correlation": {
        "#attributes": {
          "ActivityID": "6B3DFF46-F4E6-4CDA-983B-76B101728AA5"
        }
      },
      "Execution": {
        "#attributes": {
          "ProcessID": 7380,
          "ThreadID": 12856
        }
      },
      "Channel": "Microsoft-Windows-Windows Defender/Operational",
      "Computer": "swachchhanda",
      "Security": {
        "#attributes": {
          "UserID": "S-1-5-18"
        }
      }
    },
    "EventData": {
      "Product Name": "Microsoft Defender Antivirus",
      "Product Version": "4.18.26030.3011",
      "Detection ID": "{79C5C2FF-764A-4F0D-940E-A6914A52C0F9}",
      "Detection Time": "2026-04-17T04:14:08.003Z",
      "Unused": "",
      "Unused2": "",
      "Threat ID": "17463",
      "Threat Name": "Tool:Win32/EICAR_Test_File",
      "Severity ID": "5",
      "Severity Name": "Severe",
      "Category ID": "34",
      "Category Name": "Tool",
      "FWLink": "https://go.microsoft.com/fwlink/?linkid=37020&name=Tool:Win32/EICAR_Test_File&threatid=17463&enterprise=0",
      "Status Code": "103",
      "Status Description": "",
      "State": "5",
      "Source ID": "3",
      "Source Name": "Real-Time Protection",
      "Process Name": "C:\\Users\\xodih\\Downloads\\RedSun.exe",
      "Detection User": "swachchhanda\\xodih",
      "Unused3": "",
      "Path": "file:_C:\\Users\\xodih\\AppData\\Local\\Temp\\RS-{C6E9CA10-8D55-41A1-AD3D-F14D118B68C7}\\TieringEngineService.exe",
      "Origin ID": "1",
      "Origin Name": "Local machine",
      "Execution ID": "1",
      "Execution Name": "Suspended",
      "Type ID": "0",
      "Type Name": "Concrete",
      "Pre Execution Status": "3",
      "Action ID": "2",
      "Action Name": "Quarantine",
      "Unused4": "",
      "Error Code": "0x80070020",
      "Error Description": "The process cannot access the file because it is being used by another process.",
      "Unused5": "",
      "Post Clean Status": "3",
      "Additional Actions ID": "0",
      "Additional Actions String": "No additional actions required",
      "Remediation User": "NT AUTHORITY\\SYSTEM",
      "Unused6": "",
      "Security intelligence Version": "AV: 1.449.142.0, AS: 1.449.142.0, NIS: 1.449.142.0",
      "Engine Version": "AM: 1.1.26030.3008, NIS: 1.1.26030.3008"
    }
  }
}
