EventID:5145 ShareName:\\\\\*\\ADMIN$ (RelativeTargetName:SYSTEM32\\* RelativeTargetName:.tmp*)