Event ID 8043 — Process RegisterUninstallStringEventData.ProcessName attempted to register UninstallString RegisterUninstallStringEventData.UninstallString, Status: RegisterUninstallStringEventData.Status.

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8043,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:02:05.721093+00:00",
    "event_record_id": 43,
    "correlation": {},
    "execution": {
      "process_id": 12912,
      "thread_id": 13892
    },
    "channel": "Microsoft-Windows-AppLocker/EXE and DLL",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "user_data": {
    "RegisterUninstallStringEventData": {
      "UninstallStringLength": 43,
      "UninstallString": "\"C:\\Program Files\\TeamViewer\\uninstall.exe\"",
      "UninstallerPathLength": 53,
      "UninstallerPath": "\\DosDevices\\C:\\Program Files\\TeamViewer\\uninstall.exe",
      "ProcessNameLength": 78,
      "ProcessName": "\\Device\\HarddiskVolume4\\Users\\User\\AppData\\Local\\Temp\\CDD35C~1\\TeamViewer_.exe",
      "SessionId": "F205B252-1454-4144-BD5A-E00D8E398514",
      "SubSessionId": "0A236C0E-D7AD-508F-13CB-E8248F7D7476",
      "Status": 0
    }
  },
  "message": ""
}