Event 4672 isn't correctly parsed

Event 4672 isn't correctly parsed. Given this element from the log description:
```
Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
                        ...
```
Only the SeAssignPrimaryTokenPrivilege will be added as value to key Privileges