Windows event logEvent ID 25
2 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 25
2 channels
- Microsoft-Windows-Sysmon/OperationalProcessTampering (Process image change)Microsoft-Windows-Sysmon%4Operational.evtx
- Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop Services: Session reconnection succeededMicrosoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx