| source | Count | | sum | 140 |
| Service Control Manager | 39 |
| Print | 35 |
| EventLog | 28 |
| Srv | 16 |
| Application Popup | 14 |
| RemoteAccess | 8 |
| source | Count | | sum | 111 |
| Service Control Manager | 44 |
| EventLog | 29 |
| RemoteAccess | 14 |
| Srv | 13 |
| Application Popup | 11 |
| source | Count | | sum | 84 |
| Print | 41 |
| Service Control Manager | 16 |
| EventLog | 11 |
| RemoteAccess | 6 |
| Srv | 6 |
| Application Popup | 4 |
| source | Count | | sum | 64 |
| Service Control Manager | 20 |
| EventLog | 16 |
| Srv | 10 |
| Print | 7 |
| RemoteAccess | 6 |
| Application Popup | 5 |
| source | Count | | sum | 48 |
| Service Control Manager | 16 |
| EventLog | 12 |
| RemoteAccess | 8 |
| Srv | 8 |
| Application Popup | 4 |
| source | Count | | sum | 43 |
| Service Control Manager | 16 |
| EventLog | 12 |
| Srv | 8 |
| Application Popup | 4 |
| RemoteAccess | 2 |
| Tcpip | 1 |
| source | Count | | sum | 34 |
| RemoteAccess | 10 |
| EventLog | 9 |
| Service Control Manager | 9 |
| Srv | 4 |
| Application Popup | 2 |
| source | Count | | sum | 25 |
| Service Control Manager | 8 |
| EventLog | 5 |
| Application Popup | 4 |
| Srv | 4 |
| RemoteAccess | 2 |
| Print | 2 |
| source | Count | | sum | 24 |
| Service Control Manager | 8 |
| EventLog | 6 |
| Srv | 4 |
| RemoteAccess | 2 |
| Application Popup | 2 |
| Tcpip | 1 |
| BROWSER | 1 |
| source | Count | | sum | 20 |
| Service Control Manager | 8 |
| EventLog | 6 |
| RemoteAccess | 2 |
| Application Popup | 2 |
| Srv | 2 |
| source | Count | | sum | 18 |
| RemoteAccess | 6 |
| Service Control Manager | 5 |
| EventLog | 4 |
| Srv | 2 |
| Application Popup | 1 |
| source | Count | | sum | 15 |
| Service Control Manager | 4 |
| RemoteAccess | 4 |
| EventLog | 3 |
| Srv | 2 |
| Print | 1 |
| Application Popup | 1 |
| source | Count | | sum | 7 |
| Service Control Manager | 4 |
| EventLog | 2 |
| Application Popup | 1 |