{
  "Rows": [
    {
      "Index": 0,
      "Sha256": "ed1b47b525e0b6376a4971cb3f0b0cc41e210c861c0c9dbff3bed7aaf56cedd8",
      "ManagedEventTimeUtc": "2026-04-26T01:24:13.6890000Z",
      "ManagedReceivedTimeUtc": "2026-04-26T01:24:14.0694578Z",
      "ManagedEventType": "User.Write.Secured",
      "EventTimeFileTimeOffsets": [
        "0x0018"
      ],
      "ReceivedTimeFileTimeOffsets": [],
      "UInt32_0": 2425116024,
      "UInt32_4": 32764,
      "UInt32_16": 3276024449,
      "UInt32_24": 1681784464,
      "CandidateGuidsFirst512": [
        "0x0000:908c5578-7ffc-0000-f9d6-0943872add44",
        "0x0008:4309d6f9-2a87-44dd-812a-44c3da2a0d48",
        "0x0010:c3442a81-2ada-480d-90fe-3d641bd5dc01",
        "0x0018:643dfe90-d51b-01dc-0000-000000000000",
        "0x0028:43e1fa80-015d-0000-b04b-f4255d012600",
        "0x0030:25f44bb0-015d-0026-1200-000000000000",
        "0x0048:cac30000-7ffc-0000-30e2-c3cafc7f0000",
        "0x0088:c82f0000-0031-0000-b5eb-67cafc7f0000"
      ]
    },
    {
      "Index": 1,
      "Sha256": "59226efdb1ec72d19ac46d49c6b34738f7cbc9b0cbb9073024b13aaffb2c79c5",
      "ManagedEventTimeUtc": "2026-04-26T01:27:27.5750000Z",
      "ManagedReceivedTimeUtc": "2026-04-26T01:27:28.0515993Z",
      "ManagedEventType": "User.Write.Secured",
      "EventTimeFileTimeOffsets": [
        "0x0018"
      ],
      "ReceivedTimeFileTimeOffsets": [],
      "UInt32_0": 2425116024,
      "UInt32_4": 32764,
      "UInt32_16": 1261349795,
      "UInt32_24": 3620644464,
      "CandidateGuidsFirst512": [
        "0x0000:908c5578-7ffc-0000-1a66-179b9f7f7641",
        "0x0008:9b17661a-7f9f-4176-a3ab-2e4bd2bdf7af",
        "0x0010:4b2eaba3-bdd2-aff7-70a6-ced71bd5dc01",
        "0x0018:d7cea670-d51b-01dc-0000-000000000000",
        "0x00C8:3f800000-015d-0000-5036-de435d010000",
        "0x00E0:43df1b30-015d-0000-301f-df435d010000",
        "0x00E8:43df1f30-015d-0000-301f-df435d010000",
        "0x0110:ca5fa300-7ffc-0000-01d1-f7e569d20000"
      ]
    },
    {
      "Index": 2,
      "Sha256": "780af7ec3a20ca264d16357c64e47bae7782d2e0cf38bb4a144c69160d25d7d0",
      "ManagedEventTimeUtc": "2026-04-26T01:27:55.5750000Z",
      "ManagedReceivedTimeUtc": "2026-04-26T01:27:56.0491226Z",
      "ManagedEventType": "User.Write.Secured",
      "EventTimeFileTimeOffsets": [
        "0x0018"
      ],
      "ReceivedTimeFileTimeOffsets": [],
      "UInt32_0": 2425116024,
      "UInt32_4": 32764,
      "UInt32_16": 203626129,
      "UInt32_24": 3900644464,
      "CandidateGuidsFirst512": [
        "0x0000:908c5578-7ffc-0000-6409-7dc6ab5afb44",
        "0x0008:c67d0964-5aab-44fb-9116-230c0dd54f03",
        "0x0010:0c231691-d50d-034f-701c-7fe81bd5dc01",
        "0x0018:e87f1c70-d51b-01dc-0000-000000000000",
        "0x0048:c82f0000-0031-0000-8434-80cafc7f0000",
        "0x00C8:3f800000-0000-0000-5036-de435d010000",
        "0x00E0:43df06e0-015d-0000-e00a-df435d010000",
        "0x00E8:43df0ae0-015d-0000-e00a-df435d010000"
      ]
    }
  ],
  "Count": 3,
  "Notes": "Raw EventQueryResultRow snapshots are retained only under ignored artifacts. This doc stores hashes, managed timestamps, and matching FILETIME offsets."
}