((EventID:4000 (ShareName:IPC$* OR ShareName:ADMIN$* OR ShareName:C$*)) (SigningUsed:false OR EncyptionUsed:false)) (-((ClientAddress:127.* OR ClientAddress:169.254.* OR ClientAddress:\:\:1 OR ClientAddress:fe8* OR ClientAddress:fe9* OR ClientAddress:fea* OR ClientAddress:feb* OR ClientAddress:fc* OR ClientAddress:fd*) OR (ClientAddress:00000000000000000000000000000001* OR ClientAddress:FE80000000000000* OR ClientAddress:FC00000000000000* OR ClientAddress:0200****7F* OR ClientAddress:0200****A9FE*)))