Kerberos authorization

#201 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CaptureService_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CaptureService_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.218
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#202 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CaptureService_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k LocalService -p
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CaptureService_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.218
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#203 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225

SP.socpedia.net

SP$

Service Information: Service Name

UdkUserSvc_a1cd52d

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service Information: Service Name: UdkUserSvc_a1cd52d
Service Information: Service File Name: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup
Service Information: Service Type: 0xe0
Service Information: Service Start Type: 3
Service Information: Service Account: LocalSystem
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#204 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\cbdhsvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\cbdhsvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.220
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#205 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\cbdhsvc_a1cd52d\Start

Details: DWORD (0x00000002)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\cbdhsvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.220
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#206 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225

SP.socpedia.net

SP$

Service Information: Service Name

UnistoreSvc_a1cd52d

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service Information: Service Name: UnistoreSvc_a1cd52d
Service Information: Service File Name: C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type: 0xe0
Service Information: Service Start Type: 3
Service Information: Service Account: LocalSystem
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#207 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225

SP.socpedia.net

SP$

Service Information: Service Name

UserDataSvc_a1cd52d

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service Information: Service Name: UserDataSvc_a1cd52d
Service Information: Service File Name: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type: 0xe0
Service Information: Service Start Type: 3
Service Information: Service Account: LocalSystem
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#208 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225

SP.socpedia.net

SP$

Service Information: Service Name

WpnUserService_a1cd52d

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service Information: Service Name: WpnUserService_a1cd52d
Service Information: Service File Name: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type: 0xe0
Service Information: Service Start Type: 2
Service Information: Service Account: LocalSystem
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#209 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CDPUserSvc_a1cd52d\Start

Details: DWORD (0x00000002)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CDPUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.222
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#210 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CDPUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CDPUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.222
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#211 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CloudBackupRestoreSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CloudBackupRestoreSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.223
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#212 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CloudBackupRestoreSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CloudBackupRestoreSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.226
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#213 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\ConsentUxUserSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\ConsentUxUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.228
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#214 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\ConsentUxUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\ConsentUxUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.230
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#215 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.230
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#216 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\CredentialEnrollmentManager.exe
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.232
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#217 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1ac
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\svchost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 5052

#218 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k DevicesFlow -p
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.233
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#219 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.232
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#220 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\DevicePickerUserSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\DevicePickerUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.235
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#221 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\DevicePickerUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\DevicePickerUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.235
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#222 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\DevicesFlowUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\DevicesFlowUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.238
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#223 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\DevicesFlowUserSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\DevicesFlowUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.238
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#224 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\NPSMSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\NPSMSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.240
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#225 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\NPSMSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k LocalService -p
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\NPSMSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.240
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#226 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\OneSyncSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\OneSyncSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.242
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#227 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\OneSyncSvc_a1cd52d\Start

Details: DWORD (0x00000002)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\OneSyncSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.242
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#228 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\P9RdrService_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\P9RdrService_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.244
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#229 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\P9RdrService_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k P9RdrService -p
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\P9RdrService_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.244
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#230 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.247
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#231 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.247
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#232 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.248
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#233 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k PrintWorkflow
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.249
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#234 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\UdkUserSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\UdkUserSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.250
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#235 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\UdkUserSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\UdkUserSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.250
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#236 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

sihost.exe

Command Line: sihost.exe
Image: C:\Windows\System32\sihost.exe
Process GUID: {88ea2655-da8c-6abb-c21d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: sihost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManager
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9cae-6ab2-3a00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=865A05267A2F76501A847A7CB4246E5AF6657C15,SHA256=371E36931C68C136F14565DFC1AEF0D237F905FA18586E489E7C12A18AB3CD57,IMPHASH=0C2E5D141ACA7FB7E39618995321C151
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 6888
Parent Process ID: 2764
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#237 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\UnistoreSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\UnistoreSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.252
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#238 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\UnistoreSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\UnistoreSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.252
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#239 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\UserDataSvc_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\UserDataSvc_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.254
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#240 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\UserDataSvc_a1cd52d\Start

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\UserDataSvc_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.254
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#241 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\WpnUserService_a1cd52d\Start

Details: DWORD (0x00000002)
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\WpnUserService_a1cd52d\Start
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.257
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#242 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\System\CurrentControlSet\Services\WpnUserService_a1cd52d\ImagePath

Details: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Event Type: SetValue
Image: C:\WINDOWS\system32\services.exe
Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID: 868
Target Object: HKLM\System\CurrentControlSet\Services\WpnUserService_a1cd52d\ImagePath
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.257
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#243 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

Command Line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
Image: C:\Windows\System32\svchost.exe
Process GUID: {88ea2655-da8c-6abb-c31d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: svchost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 428
Parent Process ID: 868
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#244 2026-09-29 20:34:36

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process: Process Name

C:\Windows\System32\lsass.exe

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Service: Server: NT Local Security Authority / Authentication Service
Service: Service Name: LsaRegisterLogonProcess()
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x36c
Process: Process Name: C:\Windows\System32\lsass.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 6468

#245 2026-09-29 20:34:36

Remote Desktop Services: Shell start notification received (22 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Source Network Address

192.168.0.231

User: SOCPEDIA\localadmin
Session ID: 7
Source Network Address: 192.168.0.231
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 940
ThreadID: 4396

#246 2026-09-29 20:34:36

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Image

C:\Windows\System32\LogonUI.exe

Image: C:\Windows\System32\LogonUI.exe
Process GUID: {88ea2655-da89-6abb-b81d-000000000700}
Process ID: 2888
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.404
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#247 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.231

ws2025.socpedia.net

SOCPEDIA\localadmin

Target Object

HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\SOFTWARE\Microsoft\Terminal Server Client\Servers\sp.socpedia.net\UsernameHint

Details: SOCPEDIA\localadmin
Event Type: SetValue
Image: C:\WINDOWS\system32\mstsc.exe
Process GUID: {93585ce4-da0b-6abb-4c33-000000001800}
Process ID: 7452
Target Object: HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\SOFTWARE\Microsoft\Terminal Server Client\Servers\sp.socpedia.net\UsernameHint
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:36.435
IP: 192.168.0.231
Computer: ws2025.socpedia.net
ProcessPID: 3344
ThreadID: 2392

#248 2026-09-29 20:34:36

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Filename

C:\Users\LOCALA~1\AppData\Local\Temp\7

Creation UTC Time: 2026-09-29 15:34:36.423
Image: C:\WINDOWS\System32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-3700-000000000700}
Process ID: 2736
Target Filename: C:\Users\LOCALA~1\AppData\Local\Temp\7
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.424
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#249 2026-09-29 20:34:36

WDDM graphics mode is enabled (263 "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational")

192.168.0.225

SP.socpedia.net

IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 1076
ThreadID: 8712

#250 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema

Details: DWORD (0x00010002)
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#251 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#252 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index

Details: DWORD (0x00000003)
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#253 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor

Details: D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#254 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI

Details: \Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#255 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#256 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.463
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#257 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x20ac
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\svchost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#258 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService

Command Line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
Image: C:\Windows\System32\svchost.exe
Process GUID: {88ea2655-da8c-6abb-c41d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: svchost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 8364
Parent Process ID: 868
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#259 2026-09-29 20:34:36

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\UUS\amd64\MoNotificationUx.exe

Image: C:\Windows\UUS\amd64\MoNotificationUx.exe
Process GUID: {88ea2655-da8c-6abb-c11d-000000000700}
Process ID: 2332
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:36.611
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#260 2026-09-29 20:34:36

Task registration updated (140 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\SP$

Task Information: Task Name

\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Task Information: Task Name: \Microsoft\Windows\UpdateOrchestrator\Schedule Work
UserName: SOCPEDIA\SP$
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#261 2026-09-29 20:34:36

A scheduled task was updated (4702 "Security")

192.168.0.225

SP.socpedia.net

SP$

Task Information: Task Name

\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Task Information: Task Name: \Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content: <?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-30T02:38:27+05:00</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <UserId>S-1-5-18</UserId> <RunLevel>LeastPrivilege</RunLevel> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>false</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime: 1970324836982207
Other Information: ClientProcessId: 4880
Other Information: ParentProcessId: 868
Other Information: RpcCallClientLocality: 0
Other Information: FQDN: SP.socpedia.net
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#262 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\WindowsColorSystem\Calibration Loader

Task Information: Task Name: \Microsoft\Windows\WindowsColorSystem\Calibration Loader
UserName: SOCPEDIA\localadmin
Instance ID: {62f0fc02-7049-4073-b4ae-f4c1b1ea7009}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#263 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

taskhostw.exe

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1838
Process Information: Creator Process ID: 0x968
Process Information: New Process Name: C:\Windows\System32\taskhostw.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: taskhostw.exe
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#264 2026-09-29 20:34:36

Created task process (129 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\WindowsColorSystem\Calibration Loader

Task Information: Task Name: \Microsoft\Windows\WindowsColorSystem\Calibration Loader
Path: taskhostw.exe
Process ID: 6200
Priority: 32
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#265 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

taskhostw.exe

Command Line: taskhostw.exe
Image: C:\Windows\System32\taskhostw.exe
Process GUID: {88ea2655-da8c-6abb-c51d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: taskhostw.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=51B30EF11B5D3E8973A4842AD302E775A4BEBF16,SHA256=81B033630F0DF0AF3F6D93FB455B16A31CFEB58960BAE12B5292D91E17D82FCB,IMPHASH=2196268E7A2880E3ADC74481297D0C4B
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 6200
Parent Process ID: 2408
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#266 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\WindowsColorSystem\Calibration Loader

Task Information: Task Name: \Microsoft\Windows\WindowsColorSystem\Calibration Loader
User Context: SOCPEDIA\localadmin
Instance ID: {62f0fc02-7049-4073-b4ae-f4c1b1ea7009}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#267 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15DD8453-F3D8-4527-B538-E2365179F5BB}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15DD8453-F3D8-4527-B538-E2365179F5BB}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.676
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#268 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\WindowsColorSystem\Calibration Loader

Task Information: Task Name: \Microsoft\Windows\WindowsColorSystem\Calibration Loader
Action Name: Color Calibration Loader
Task Instance ID: {62f0fc02-7049-4073-b4ae-f4c1b1ea7009}
Engine PID: 6200
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#269 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Plug and Play\Device Install Reboot Required

Task Information: Task Name: \Microsoft\Windows\Plug and Play\Device Install Reboot Required
UserName: SOCPEDIA\localadmin
Instance ID: {d1735e78-2133-48f0-94da-5b920de9f4c7}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#270 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

taskhostw.exe

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x10c
Process Information: Creator Process ID: 0x968
Process Information: New Process Name: C:\Windows\System32\taskhostw.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: taskhostw.exe
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 6468

#271 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

taskhostw.exe

Command Line: taskhostw.exe
Image: C:\Windows\System32\taskhostw.exe
Process GUID: {88ea2655-da8c-6abb-c61d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: taskhostw.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=51B30EF11B5D3E8973A4842AD302E775A4BEBF16,SHA256=81B033630F0DF0AF3F6D93FB455B16A31CFEB58960BAE12B5292D91E17D82FCB,IMPHASH=2196268E7A2880E3ADC74481297D0C4B
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 268
Parent Process ID: 2408
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#272 2026-09-29 20:34:36

Created task process (129 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Plug and Play\Device Install Reboot Required

Task Information: Task Name: \Microsoft\Windows\Plug and Play\Device Install Reboot Required
Path: taskhostw.exe
Process ID: 268
Priority: 32
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#273 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Plug and Play\Device Install Reboot Required

Task Information: Task Name: \Microsoft\Windows\Plug and Play\Device Install Reboot Required
User Context: SOCPEDIA\localadmin
Instance ID: {d1735e78-2133-48f0-94da-5b920de9f4c7}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#274 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Plug and Play\Device Install Reboot Required

Task Information: Task Name: \Microsoft\Windows\Plug and Play\Device Install Reboot Required
Action Name: Device Installation Reboot Dialog Task
Task Instance ID: {d1735e78-2133-48f0-94da-5b920de9f4c7}
Engine PID: 268
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#275 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Wininet\CacheTask

Task Information: Task Name: \Microsoft\Windows\Wininet\CacheTask
UserName: SOCPEDIA\localadmin
Instance ID: {f3913cb6-0fb2-4b57-baf9-b6d7a9d09e35}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#276 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1644
Process Information: Creator Process ID: 0x968
Process Information: New Process Name: C:\Windows\System32\taskhostw.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 6468

#277 2026-09-29 20:34:36

Created task process (129 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Wininet\CacheTask

Task Information: Task Name: \Microsoft\Windows\Wininet\CacheTask
Path: taskhostw.exe
Process ID: 5700
Priority: 32
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#278 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies

Task Information: Task Name: \Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
UserName: SOCPEDIA\localadmin
Instance ID: {88ce242d-6911-47fa-a58b-3d9557893b8b}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#279 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Wininet\CacheTask

Task Information: Task Name: \Microsoft\Windows\Wininet\CacheTask
User Context: SOCPEDIA\localadmin
Instance ID: {f3913cb6-0fb2-4b57-baf9-b6d7a9d09e35}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#280 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies

Task Information: Task Name: \Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
User Context: SOCPEDIA\localadmin
Instance ID: {88ce242d-6911-47fa-a58b-3d9557893b8b}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#281 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Wininet\CacheTask

Task Information: Task Name: \Microsoft\Windows\Wininet\CacheTask
Action Name: Wininet Cache task object
Task Instance ID: {f3913cb6-0fb2-4b57-baf9-b6d7a9d09e35}
Engine PID: 5700
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#282 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies

Task Information: Task Name: \Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
Action Name: NcsiIdentifyUserProxiesTask
Task Instance ID: {88ce242d-6911-47fa-a58b-3d9557893b8b}
Engine PID: 6200
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6056

#283 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EA397B2-B342-49F2-BE2B-D0916F251460}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EA397B2-B342-49F2-BE2B-D0916F251460}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.709
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#284 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8E30BB33-120B-4850-8843-78981F130DC4}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8E30BB33-120B-4850-8843-78981F130DC4}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.719
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#285 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

Command Line: taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
Image: C:\Windows\System32\taskhostw.exe
Process GUID: {88ea2655-da8c-6abb-c71d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: taskhostw.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=51B30EF11B5D3E8973A4842AD302E775A4BEBF16,SHA256=81B033630F0DF0AF3F6D93FB455B16A31CFEB58960BAE12B5292D91E17D82FCB,IMPHASH=2196268E7A2880E3ADC74481297D0C4B
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 5700
Parent Process ID: 2408
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#286 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\TextServicesFramework\MsCtfMonitor

Task Information: Task Name: \Microsoft\Windows\TextServicesFramework\MsCtfMonitor
UserName: SOCPEDIA\localadmin
Instance ID: {86c05b6c-e0dc-4e5a-9f90-4519dbd2a351}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6896

#287 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92505DE7-B1EC-4D5B-AA6A-2B441117E270}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92505DE7-B1EC-4D5B-AA6A-2B441117E270}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.720
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#288 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\TextServicesFramework\MsCtfMonitor

Task Information: Task Name: \Microsoft\Windows\TextServicesFramework\MsCtfMonitor
User Context: SOCPEDIA\localadmin
Instance ID: {86c05b6c-e0dc-4e5a-9f90-4519dbd2a351}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6896

#289 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\TextServicesFramework\MsCtfMonitor

Task Information: Task Name: \Microsoft\Windows\TextServicesFramework\MsCtfMonitor
Action Name: MsCtfMonitor task handler
Task Instance ID: {86c05b6c-e0dc-4e5a-9f90-4519dbd2a351}
Engine PID: 5700
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 6896

#290 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\CertificateServicesClient\UserTask

Task Information: Task Name: \Microsoft\Windows\CertificateServicesClient\UserTask
Action Name: Certificate Services Client Task Handler
Task Instance ID: {1db1f90b-928a-42bd-a7b4-6eb556f08c21}
Engine PID: 6200
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#291 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\CertificateServicesClient\UserTask

Task Information: Task Name: \Microsoft\Windows\CertificateServicesClient\UserTask
UserName: SOCPEDIA\localadmin
Instance ID: {1db1f90b-928a-42bd-a7b4-6eb556f08c21}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#292 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\CertificateServicesClient\UserTask

Task Information: Task Name: \Microsoft\Windows\CertificateServicesClient\UserTask
User Context: SOCPEDIA\localadmin
Instance ID: {1db1f90b-928a-42bd-a7b4-6eb556f08c21}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 1796

#293 2026-09-29 20:34:36

Logon trigger (119 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Task Information: Task Name

\Microsoft\Windows\Management\Provisioning\Logon

Task Information: Task Name: \Microsoft\Windows\Management\Provisioning\Logon
UserName: SOCPEDIA\localadmin
Instance ID: {3aa70e95-f2e6-420e-a740-d991eaafe554}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#294 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"C:\WINDOWS\system32\ProvTool.exe" /turn 5 /source LogonIdleTask

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x1424
Process Information: Creator Process ID: 0x968
Process Information: New Process Name: C:\Windows\System32\provtool.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\WINDOWS\system32\ProvTool.exe" /turn 5 /source LogonIdleTask
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#295 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B43A1E6-1A57-42A0-9D94-B54028D5B833}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B43A1E6-1A57-42A0-9D94-B54028D5B833}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.733
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#296 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A60EE6FD-40BA-4476-8AF0-1787C15F6A88}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Process ID: 2408
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A60EE6FD-40BA-4476-8AF0-1787C15F6A88}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:36.740
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#297 2026-09-29 20:34:36

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Management\Provisioning\Logon

Task Information: Task Name: \Microsoft\Windows\Management\Provisioning\Logon
Action Name: %windir%\system32\ProvTool.exe
Task Instance ID: {3aa70e95-f2e6-420e-a740-d991eaafe554}
Engine PID: 5156
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#298 2026-09-29 20:34:36

Created task process (129 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Management\Provisioning\Logon

Task Information: Task Name: \Microsoft\Windows\Management\Provisioning\Logon
Path: %windir%\system32\ProvTool.exe
Process ID: 5156
Priority: 64
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#299 2026-09-29 20:34:36

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Task Information: Task Name

\Microsoft\Windows\Management\Provisioning\Logon

Task Information: Task Name: \Microsoft\Windows\Management\Provisioning\Logon
User Context: NT AUTHORITY\SYSTEM
Instance ID: {3aa70e95-f2e6-420e-a740-d991eaafe554}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 2408
ThreadID: 5668

#300 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

"C:\WINDOWS\system32\ProvTool.exe" /turn 5 /source LogonIdleTask

Command Line: "C:\WINDOWS\system32\ProvTool.exe" /turn 5 /source LogonIdleTask
Image: C:\Windows\System32\provtool.exe
Process GUID: {88ea2655-da8c-6abb-c81d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: provtool
User: NT AUTHORITY\SYSTEM
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9cac-6ab2-2e00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=33ADC8187B77B7DE68564652DAA9E742FE841CFA,SHA256=A7B61F111342E34BCD59127796E5113CA7ED198DDF8B9A2479C81B7529328A8F,IMPHASH=CF16AACF6AEF93FA7E23E88838BA2F1F
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 5156
Parent Process ID: 2408
Terminal Session ID: 0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

Event Title
Event ID
Access Request Information: Access Mask
Access Request Information: Accesses
Account Information: Logon GUID
Account Whose Credentials Were Used: Logon GUID
Action Name
Added Rule: Rule ID
Additional Information: Pre-Authentication Type
Additional Information: Privileges
Additional Information: Ticket Options
Binary
Call Trace
Calling Process Name
Certificate Information: Certificate Issuer Name
Certificate Information: Certificate Serial Number
Certificate Information: Certificate Thumbprint
Class ID
Class Name
Client certificate thumbprint
ClientMachine
Code
Compatible IDs
Component
Computer
Computer Account That Was Changed: Account Name
Connection ID
Connection Type
Count Of Credentials Returned
Creation UTC Time
Creator Subject: Account Domain
Creator Subject: Logon ID
Creator Subject: Security ID
Cryptographic Parameters: Algorithm Name
Cryptographic Parameters: Key Name
Cryptographic Parameters: Key Type
Cryptographic Parameters: Provider Name
Current Directory
DestinationHostname
DestinationIp
DestinationIsIpv6
DestinationPort
DestinationPortName
Detailed Authentication Information: Authentication Package
Details
Device
Device ID
Device Name
Domain
Engine PID
Event Type
Failure Information: Status
Granted Access
Group: Group Domain
Group: Security ID
GroupMembership
Hashes
Host Process
Id
Image
ImpersonationLevel
Initiated
Instance ID
Instance Name
Integrity Level
IP
Is Executable
Key File Operation Information: File Path
Key File Operation Information: Operation
Listener Name
Local Address
Location Information
Logon ID
Logon Information: Remote Credential Guard
Logon Information: Restricted Admin Mode
Logon Process Name
Logon Type
Network Information: Client Address
Network Information: Object Type
Network Information: Port
Network Information: Workstation Name
New Logon: Logon ID
New Thread ID
Object: Handle ID
Object: Object Name
Object: Object Server
Original File Name
Other Information: FQDN
Other Information: ParentProcessId
Other Information: ProcessCreationTime
Other Information: RpcCallClientLocality
param1
param2
Param3
Parent Command Line
Parent Image
Parent Process GUID
Parent Process Name
Parent User
Path
Port Origin
PossibleCause
Previous Creation UTC Time
Priority
Process
Process Creation Time
Process GUID
Process ID
Process Information: Caller Process ID
Process Information: Mandatory Label
Process Information: New Process ID
Process Information: New Process Name
Process Information: Process Command Line
Process Information: Process Creation Time
Process Information: Process ID
Process Information: Process ID
Process Information: Process Name
Process Information: Token Elevation Type
ProcessPID
Profile Changed
Protocol
Provider Path
Query Name
Query Results
Query Status
Remote Address
Result Code
Return Code
RuleName
Server name
Service Host Tag
Service Information: Service Account
Service Information: Service File Name
Service Information: Service Name
Service Information: Service Start Type
Service Information: Service Type
Service: Service Name
ServiceSid
Session ID
Share Information: Share Name
Share Information: Share Path
Source Image
Source Network Address
Source Process GUID
Source Process GUID
Source Process ID
Source Thread ID
Source User
SourceHostname
SourceIp
SourceIsIpv6
SourcePort
SourcePortName
Start Address
Start Function
Start Module
Subject: Account Name
Subject: Read Operation
Subject: Security ID
Target Filename
Target Image
Target Name
Target Object
Target Process GUID
Target Process GUID
Target Process ID
Target Server: Additional Information
Target Server: Target Server Name
Target User
Task Information: Task Name
Task Information: Task New Content
Task Instance ID
Terminal Session ID
ThreadID
Ticket information: Request ticket hash
Ticket information: Response ticket hash
Ticket information: Response ticket hash
TicketEncryptionType
Transmitted Services
TS ID
Type
User
User
User
User Context
User SID
UTC Time
Vendor IDs