EventID:4697 (ServiceFileName:cachedump* OR ServiceFileName:dumpsvc* OR ServiceFileName:fgexec* OR ServiceFileName:gsecdump* OR ServiceFileName:mimidrv* OR ServiceFileName:pwdump* OR ServiceFileName:servpw*)