Loading...
SOCpedia Logo SOCpedia
Timelines

Kerberos authorization

711 29.09.2026 20:50
  1. From workstation ws2025.socpedia.net we connect via RDP to sp.socpedia.net using the domain account lacaladmin with an incorrect password.
  2. From workstation ws2025.socpedia.net we connect via RDP to sp.socpedia.net using the domain account lacaladmin with the correct password.

  3. On workstation sp.socpedia.net we perform Sign out for the account localadmin. 

    Events highlighted in yellow represent the most interest for analyzing the activity.

Clear Filter
Matched Events: 492 / Total Events: 492
#101 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#102 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x814
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7556
#103 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Command Line
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -s ScDeviceEnum
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da8a-6abb-bb1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
2068
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#104 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x14c0
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\wbem\WmiPrvSE.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7556
#105 2026-09-29 20:34:34

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
/QuitInfo:000000000000019C;0000000000000334;
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x1b14
Process Information: Creator Process ID
0xb78
Process Information: New Process Name
C:\Windows\System32\ctfmon.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
/QuitInfo:000000000000019C;0000000000000334;
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#106 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Command Line
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Image
C:\Windows\System32\wbem\WmiPrvSE.exe
Process GUID
{88ea2655-da8a-6abb-bc1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
Wmiprvse.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=1C2257B37101207E6D11C3A0456CB068B736875D,SHA256=A926DFD215FB50B506C283B5A2277569BF5F653B16364633BEC6617366C3358C,IMPHASH=8D7EA263D3290D799C6832B08F7A3F21
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
5312
Parent Process ID
1000
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#107 2026-09-29 20:34:34

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
/QuitInfo:000000000000019C;0000000000000334;
Command Line
/QuitInfo:000000000000019C;0000000000000334;
Image
C:\Windows\System32\ctfmon.exe
Process GUID
{88ea2655-da8a-6abb-bd1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
CTFMON.EXE
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9cad-6ab2-3800-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=1B3F7B8416C54DA13A51086D7C49412983720B33,SHA256=6DB24A587D68F47705F6BFC5DE76BE716E6A1437C20EB55ACCF2D2ACCDF2A400,IMPHASH=B539389D4BE1DD68C8213A539FEB41FB
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
6932
Parent Process ID
2936
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#108 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#109 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#110 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#111 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#112 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#113 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#114 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#115 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#116 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
Security Account Manager
Service: Service Name
Security Account Manager
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#117 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#118 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#119 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#120 2026-09-29 20:34:34

A trusted logon process has been registered with the Local Security Authority (4611 "Security")

192.168.0.225
SP.socpedia.net
SP$
Logon Process Name
UserManager
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Process Name
UserManager
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#121 2026-09-29 20:34:34

Process Access (10 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Image
C:\WINDOWS\system32\winlogon.exe
RuleName
v1-0_io_T_Winlogon
UTC Time
2026-09-29 15:34:34.803
Source Process GUID
{88ea2655-9ca8-6ab2-0c00-000000000700}
Source Process ID
876
Source Thread ID
740
Source Image
C:\WINDOWS\system32\lsass.exe
Target Process GUID
{88ea2655-da88-6abb-b31d-000000000700}
Target Process ID
5908
Target Image
C:\WINDOWS\system32\winlogon.exe
Granted Access
0x1478
Call Trace
C:\WINDOWS\SYSTEM32\ntdll.dll+15f2c4|C:\WINDOWS\system32\lsasrv.dll+24e84|C:\WINDOWS\system32\lsasrv.dll+2487a|C:\WINDOWS\system32\lsasrv.dll+24473|C:\WINDOWS\SYSTEM32\SspiSrv.dll+1b9d|C:\WINDOWS\System32\RPCRT4.dll+d1913|C:\WINDOWS\System32\RPCRT4.dll+d618e|C:\WINDOWS\System32\RPCRT4.dll+85cdc|C:\WINDOWS\System32\RPCRT4.dll+83897|C:\WINDOWS\System32\RPCRT4.dll+360f4|C:\WINDOWS\System32\RPCRT4.dll+37108|C:\WINDOWS\System32\RPCRT4.dll+300b4|C:\WINDOWS\System32\RPCRT4.dll+3463a|C:\WINDOWS\System32\RPCRT4.dll+3a65c|C:\WINDOWS\System32\RPCRT4.dll+397e3|C:\WINDOWS\System32\RPCRT4.dll+38788|C:\WINDOWS\SYSTEM32\ntdll.dll+51683|C:\WINDOWS\SYSTEM32\ntdll.dll+51fa3|C:\WINDOWS\System32\KERNEL32.DLL+2dbe7|C:\WINDOWS\SYSTEM32\ntdll.dll+85a6c
Source User
NT AUTHORITY\SYSTEM
Target User
NT AUTHORITY\SYSTEM
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#122 2026-09-29 20:34:34

A Kerberos authentication ticket (TGT) was requested (4768 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
::ffff:192.168.0.225
Account Information: Account Name
localadmin
Account Information: Account Domain
SOCPEDIA.NET
Account Information: User ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Service Information: Service Name
krbtgt
Service Information: Service ID
S-1-5-21-1838030176-2987033226-1986555923-502
Additional Information: Ticket Options
0x40810010
Additional Information: Failure Code
0x0
Additional Information: Ticket Encryption Type
0x12
Additional Information: Pre-Authentication Type
2
Network Information: Source Network Address
::ffff:192.168.0.225
Network Information: Client Port
65531
Ticket information: Response ticket hash
+fNuCBxjLoDpilF2lQvjqChu2JfeqXkQ+ikNwjOJwpQ=
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3144
#123 2026-09-29 20:34:34

A Kerberos service ticket was requested (4769 "Security")

192.168.0.210
DC.socpedia.net
localadmin@SOCPEDIA.NET
Network Information: Client Address
::ffff:192.168.0.225
Account Information: Account Name
localadmin@SOCPEDIA.NET
Account Information: Account Domain
SOCPEDIA.NET
Account Information: Logon GUID
{18b2b576-b27c-f4fc-f5d7-98d115ee217a}
Service Information: Service Name
SP$
Service Information: Service ID
S-1-5-21-1838030176-2987033226-1986555923-1134
Network Information: Client Address
::ffff:192.168.0.225
Network Information: Source Port
65532
Additional Information: Ticket Options
0x40810000
Additional Information: Ticket Encryption Type
0x12
Additional Information: Failure Code
0x0
Additional Information: Transited Services
-
Ticket information: Request ticket hash
+fNuCBxjLoDpilF2lQvjqChu2JfeqXkQ+ikNwjOJwpQ=
Ticket information: Response ticket hash
AFmKg0YRmQG9Vi7EL+gX4fFJZRyOYP4AlJ3aPcrFdjo=
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3484
#124 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-14} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-2-0} %{S-1-18-1} %{S-1-16-8192}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
10
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA
New Logon: Logon ID
0xa1beca3
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-555} %{S-1-5-32-545} %{S-1-5-14} %{S-1-5-4} %{S-1-5-11} %{S-1-5-15} %{S-1-2-0} %{S-1-18-1} %{S-1-16-8192}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#125 2026-09-29 20:34:34

A logon was attempted using explicit credentials (4648 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Network Information: Network Address
192.168.0.231
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Subject: Logon GUID
{00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used: Account Name
localadmin
Account Whose Credentials Were Used: Account Domain
SOCPEDIA
Account Whose Credentials Were Used: Logon GUID
{18b2b576-b27c-f4fc-f5d7-98d115ee217a}
Target Server: Target Server Name
localhost
Target Server: Additional Information
localhost
Process Information: Process ID
0xacc
Process Information: Process Name
C:\Windows\System32\svchost.exe
Network Information: Network Address
192.168.0.231
Network Information: Port
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#126 2026-09-29 20:34:34

A trusted logon process has been registered with the Local Security Authority (4611 "Security")

192.168.0.225
SP.socpedia.net
SP$
Logon Process Name
UserManager
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Process Name
UserManager
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#127 2026-09-29 20:34:34

A privileged service was called (4673 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process: Process Name
C:\Windows\System32\lsass.exe
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service: Server
NT Local Security Authority / Authentication Service
Service: Service Name
LsaRegisterLogonProcess()
Service Request Information: Privileges
SeTcbPrivilege
Process: Process ID
0x36c
Process: Process Name
C:\Windows\System32\lsass.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
2272
#128 2026-09-29 20:34:34

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.231
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
10
Logon Information: Restricted Admin Mode
%%1843
Logon Information: Remote Credential Guard
%%1843
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA
New Logon: Logon ID
0xa1beca3
Account Information: Logon GUID
{18b2b576-b27c-f4fc-f5d7-98d115ee217a}
Process Information: Process ID
0xacc
Process Information: Process Name
C:\Windows\System32\svchost.exe
Network Information: Workstation Name
SP
Network Information: Source Network Address
192.168.0.231
Network Information: Client Port
0
Detailed Authentication Information: Logon Process
User32
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#129 2026-09-29 20:34:34

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cea3
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#130 2026-09-29 20:34:34

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cea3
Account Information: Logon GUID
{79a5782e-8614-9316-0685-06f414871eb5}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
65534
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#131 2026-09-29 20:34:34

Begin session arbitration (41 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Session ID
7
User
SOCPEDIA\localadmin
Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
940
ThreadID
5048
#132 2026-09-29 20:34:34

End session arbitration (42 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Session ID
7
User
SOCPEDIA\localadmin
Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
940
ThreadID
5048
#133 2026-09-29 20:34:34

User Logon Notification for Customer Experience Improvement Program (7001 "System")

192.168.0.225
SP.socpedia.net
User SID
S-1-5-21-1838030176-2987033226-1986555923-1140
TS ID
7
User SID
S-1-5-21-1838030176-2987033226-1986555923-1140
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
5908
ThreadID
6760
#134 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Flags
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Flags
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#135 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\FullProfile
Details
DWORD (0x00000001)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\FullProfile
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#136 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Sid
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\Sid
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#137 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\State
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\State
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#138 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeLow
Details
DWORD (0x07c8d2c9)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeLow
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#139 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeHigh
Details
DWORD (0x01dd5028)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\LocalProfileLoadTimeHigh
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.049
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#140 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeLow
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeLow
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.051
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#141 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeHigh
Details
DWORD (0x00000000)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1838030176-2987033226-1986555923-1140\ProfileAttemptedProfileDownloadTimeHigh
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.051
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#142 2026-09-29 20:34:35

A security-enabled local group membership was enumerated (4799 "Security")

192.168.0.225
SP.socpedia.net
SP$
Group: Group Name
Administrators
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Group: Security ID
S-1-5-32-544
Group: Group Name
Administrators
Group: Group Domain
Builtin
Process Information: Process ID
0x7c8
Process Information: Process Name
C:\Windows\System32\svchost.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
740
#143 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDNSDOMAIN
Details
SOCPEDIA.NET
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDNSDOMAIN
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.074
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#144 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDOMAIN
Details
SOCPEDIA
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cab-6ab2-2700-000000000700}
Process ID
1992
Target Object
HKU\S-1-5-21-1838030176-2987033226-1986555923-1140\Volatile Environment\USERDOMAIN
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.074
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#145 2026-09-29 20:34:35

A Kerberos service ticket was requested (4769 "Security")

192.168.0.210
DC.socpedia.net
localadmin@SOCPEDIA.NET
Network Information: Client Address
::ffff:192.168.0.225
Account Information: Account Name
localadmin@SOCPEDIA.NET
Account Information: Account Domain
SOCPEDIA.NET
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Service Information: Service Name
DC$
Service Information: Service ID
S-1-5-21-1838030176-2987033226-1986555923-1000
Network Information: Client Address
::ffff:192.168.0.225
Network Information: Source Port
49152
Additional Information: Ticket Options
0x40800000
Additional Information: Ticket Encryption Type
0x12
Additional Information: Failure Code
0x0
Additional Information: Transited Services
-
Ticket information: Request ticket hash
+fNuCBxjLoDpilF2lQvjqChu2JfeqXkQ+ikNwjOJwpQ=
Ticket information: Response ticket hash
5kij2b/snygV88JUNxVV28mDA79eHuYZ3Lxdo+SmOno=
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3144
#146 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cec1
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
65534
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#147 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cec1
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#148 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cede
Account Information: Logon GUID
{478fa719-96b1-aaff-cdfe-cc3cf8c5a808}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49153
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#149 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cede
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#150 2026-09-29 20:34:35

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\Windows\System32\config\netlogon.ftl
Creation UTC Time
2026-08-18 11:56:21.735
Image
C:\WINDOWS\system32\lsass.exe
Process GUID
{88ea2655-9ca8-6ab2-0c00-000000000700}
Process ID
876
Target Filename
C:\Windows\System32\config\netlogon.ftl
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.169
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#151 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
SP$
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cef4
Account Information: Logon GUID
{bd85057f-7674-3020-af7c-99dcbe5dcb2e}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49154
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3484
#152 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
SP$
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name
SP$
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cef4
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
3484
#153 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.210
DC.socpedia.net
localadmin
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Type
3
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cf0b
GroupMembership
%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#154 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Network Information: Source Network Address
192.168.0.225
Subject: Security ID
S-1-0-0
Subject: Account Name
-
Subject: Account Domain
-
Subject: Logon ID
0x0
Logon Information: Logon Type
3
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name
localadmin
New Logon: Account Domain
SOCPEDIA.NET
New Logon: Logon ID
0x1240cf0b
Account Information: Logon GUID
{3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID
0x0
Process Information: Process Name
-
Network Information: Workstation Name
-
Network Information: Source Network Address
192.168.0.225
Network Information: Client Port
49155
Detailed Authentication Information: Logon Process
Kerberos
Detailed Authentication Information: Authentication Package
Kerberos
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
7144
#155 2026-09-29 20:34:35

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
localadmin
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1240cf0b
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
720
#156 2026-09-29 20:34:35

An account was logged off (4634 "Security")

192.168.0.210
DC.socpedia.net
SP$
Logon Type
3
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x1240cef4
Logon Type
3
IP
192.168.0.210
Computer
DC.socpedia.net
ProcessPID
844
ThreadID
5212
#157 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\SD
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.502
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#158 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work\Index
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.504
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#159 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
Details
DWORD (0x00010002)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Schema
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.505
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#160 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Hash
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.505
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#161 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
Details
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\SecurityDescriptor
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.505
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#162 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
Details
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\URI
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#163 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Triggers
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#164 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
Details
Binary Data
Event Type
SetValue
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2e00-000000000700}
Process ID
2408
Target Object
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3094C9BD-C1D9-45D5-BEC5-53B2F64CD45A}\Actions
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#165 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Control\Class\{c166523c-fe0c-4a94-a586-f1a80cfbbf3e}\0000\DriverVersion
Details
10.0.26100.1
Event Type
SetValue
Image
System
Process GUID
{88ea2655-9c98-6ab2-eb03-000000000000}
Process ID
4
Target Object
HKLM\System\CurrentControlSet\Control\Class\{c166523c-fe0c-4a94-a586-f1a80cfbbf3e}\0000\DriverVersion
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.506
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#166 2026-09-29 20:34:35

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1cb8
Process Information: Creator Process ID
0x3e8
Process Information: New Process Name
C:\Windows\System32\TSTheme.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
5052
#167 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Enum\SWD\MMDEVAPI\{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}\FriendlyName
Details
Remote Audio
Event Type
SetValue
Image
System
Process GUID
{88ea2655-9c98-6ab2-eb03-000000000000}
Process ID
4
Target Object
HKLM\System\CurrentControlSet\Enum\SWD\MMDEVAPI\{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}\FriendlyName
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.511
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#168 2026-09-29 20:34:35

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Control\DeviceClasses\{e6327cad-dcec-4949-ae8a-991e976a79d2}\##?#SWD#MMDEVAPI#{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}#{e6327cad-dcec-4949-ae8a-991e976a79d2}\#\Device Parameters\FriendlyName
Details
Remote Audio
Event Type
SetValue
Image
C:\WINDOWS\System32\svchost.exe
Process GUID
{88ea2655-9cac-6ab2-2f00-000000000700}
Process ID
2440
Target Object
HKLM\System\CurrentControlSet\Control\DeviceClasses\{e6327cad-dcec-4949-ae8a-991e976a79d2}\##?#SWD#MMDEVAPI#{3.0.0.00000007}.{6C26BA7D-F0B2-4225-B422-8168C5261E45}#{e6327cad-dcec-4949-ae8a-991e976a79d2}\#\Device Parameters\FriendlyName
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:35.546
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#169 2026-09-29 20:34:35

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Command Line
C:\WINDOWS\system32\TSTheme.exe -Embedding
Image
C:\Windows\System32\TSTheme.exe
Process GUID
{88ea2655-da8b-6abb-be1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
TSThemeS.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=4B696349A9A2E131DF492390C3F86CCA826E90DA,SHA256=FDA3E9D3E468CCB7303085D77FD7B927EECEF4758AD8F6CC3E94AB9FB7B544EC,IMPHASH=DBA57ED5E1DD53B043DA5AD481675E39
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
7352
Parent Process ID
1000
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#170 2026-09-29 20:34:35

A scheduled task was updated (4702 "Security")

192.168.0.225
SP.socpedia.net
SP$
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Task Information: Task Name
\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Task Information: Task New Content
<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <URI>\Microsoft\Windows\UpdateOrchestrator\Schedule Work</URI> <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)</SecurityDescriptor> </RegistrationInfo> <Triggers> <TimeTrigger> <StartBoundary>2026-09-30T02:38:27+05:00</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>S-1-5-18</UserId> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT1H</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>false</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>%systemroot%\system32\usoclient.exe</Command> <Arguments>StartWork</Arguments> </Exec> </Actions> </Task>
Other Information: ProcessCreationTime
1970324836974741
Other Information: ClientProcessId
3604
Other Information: ParentProcessId
2796
Other Information: RpcCallClientLocality
0
Other Information: FQDN
SP.socpedia.net
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#171 2026-09-29 20:34:35

An account was successfully logged on (4624 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Network Information: Source Network Address
-
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Information: Logon Type
5
Logon Information: Restricted Admin Mode
-
Logon Information: Remote Credential Guard
-
ImpersonationLevel
%%1833
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
Account Information: Logon GUID
{00000000-0000-0000-0000-000000000000}
Process Information: Process ID
0x364
Process Information: Process Name
C:\Windows\System32\services.exe
Network Information: Workstation Name
-
Network Information: Source Network Address
-
Network Information: Client Port
-
Detailed Authentication Information: Logon Process
Advapi
Detailed Authentication Information: Authentication Package
Negotiate
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#172 2026-09-29 20:34:35

Special privileges assigned to new logon (4672 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Subject: Security ID
S-1-5-18
Subject: Account Name
SYSTEM
Subject: Account Domain
NT AUTHORITY
Subject: Logon ID
0x3e7
Privileges
SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer
SP.socpedia.net
ProcessPID
876
IP
192.168.0.225
ThreadID
7792
#173 2026-09-29 20:34:35

Group membership information (4627 "Security")

192.168.0.225
SP.socpedia.net
SYSTEM
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Logon Type
5
New Logon: Security ID
S-1-5-18
New Logon: Account Name
SYSTEM
New Logon: Account Domain
NT AUTHORITY
New Logon: Logon ID
0x3e7
GroupMembership
%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#174 2026-09-29 20:34:35

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
-
Target Subject: Account Domain
-
Target Subject: Logon ID
0x0
Process Information: New Process ID
0x1310
Process Information: Creator Process ID
0x364
Process Information: New Process Name
C:\Windows\System32\svchost.exe
Process Information: Creator Process Name
C:\Windows\System32\services.exe
Process Information: Process Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-16384
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
4828
#175 2026-09-29 20:34:35

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Command Line
C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Image
C:\Windows\System32\svchost.exe
Process GUID
{88ea2655-da8b-6abb-bf1d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
svchost.exe
User
NT AUTHORITY\SYSTEM
Parent Command Line
C:\WINDOWS\system32\services.exe
Parent Image
C:\Windows\System32\services.exe
Parent Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID
{88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID
0x3e7
Integrity Level
System
Process ID
4880
Parent Process ID
868
Terminal Session ID
0
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#176 2026-09-29 20:34:35

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
rdpclip
Creator Subject: Security ID
S-1-5-20
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e4
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0xa30
Process Information: Creator Process ID
0x434
Process Information: New Process Name
C:\Windows\System32\rdpclip.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
rdpclip
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#177 2026-09-29 20:34:35

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
rdpclip
Command Line
rdpclip
Image
C:\Windows\System32\rdpclip.exe
Process GUID
{88ea2655-da8b-6abb-c01d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
rdpclip.exe
User
SOCPEDIA\localadmin
Parent Command Line
C:\WINDOWS\System32\svchost.exe -k termsvcs -s TermService
Parent Image
C:\Windows\System32\svchost.exe
Parent Process GUID
{88ea2655-9caa-6ab2-1200-000000000700}
Parent User
NT AUTHORITY\NETWORK SERVICE
Hashes
SHA1=8AF528CFC7ADFE6CCD200F663B7A050DA56A7E21,SHA256=C40D77F4F722D495C78EBC17A12FAF389BC2F1ED8D5E1FBDC155C55A1B786FAF,IMPHASH=FBDEC6E4BA9A5126DECA850B0BC67149
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
2608
Parent Process ID
1076
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#178 2026-09-29 20:34:35

Remote Desktop Services: Session logon succeeded (21 "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Source Network Address
192.168.0.231
User
SOCPEDIA\localadmin
Session ID
7
Source Network Address
192.168.0.231
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
940
ThreadID
5048
#179 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x91c
Process Information: Creator Process ID
0xe14
Process Information: New Process Name
C:\Windows\UUS\amd64\MoNotificationUx.exe
Process Information: Creator Process Name
C:\Windows\UUS\amd64\MoUsoCoreWorker.exe
Process Information: Process Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#180 2026-09-29 20:34:36

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
SOCPEDIA\localadmin
Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Command Line
C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Install_Blocked_Important /FormFactor Passive /CV NZadADtxsECJL5DV.1.0.0
Image
C:\Windows\UUS\amd64\MoNotificationUx.exe
Process GUID
{88ea2655-da8c-6abb-c11d-000000000700}
Current Directory
C:\WINDOWS\system32\
Original File Name
MoNotificationUx.exe
User
SOCPEDIA\localadmin
Parent Command Line
"C:\WINDOWS\uus\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces
Parent Image
C:\Windows\UUS\amd64\MoUsoCoreWorker.exe
Parent Process GUID
{88ea2655-9d39-6ab2-9500-000000000700}
Parent User
NT AUTHORITY\SYSTEM
Hashes
SHA1=AC8F2BD147803AA6E52445CC314C628D96A33862,SHA256=C7FFC918E64B26D3B581BB8F23CDAED88F2DE0452DC6CF78155CCB27FA041343,IMPHASH=857CFF3FB2363C3A60D2046BA3EE1705
Logon GUID
{88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID
0xa1beca3
Integrity Level
Medium
Process ID
2332
Parent Process ID
3604
Terminal Session ID
7
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#181 2026-09-29 20:34:36

File created (11 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Filename
C:\Windows\Logs\waasmedic\waasmedic.20260929_153436_097.etl
Creation UTC Time
2026-09-29 15:34:36.097
Image
C:\WINDOWS\system32\svchost.exe
Process GUID
{88ea2655-da8b-6abb-bf1d-000000000700}
Process ID
4880
Target Filename
C:\Windows\Logs\waasmedic\waasmedic.20260929_153436_097.etl
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.097
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#182 2026-09-29 20:34:36

An operation was attempted on a privileged object (4674 "Security")

192.168.0.225
SP.socpedia.net
localadmin
Process Information: Process Name
C:\Windows\System32\winlogon.exe
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name
localadmin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xa1beca3
Object: Object Server
Security
Object: Object Type
-
Object: Object Name
-
Object: Object Handle
0x0
Requested Operation: Desired Access
0
Requested Operation: Privileges
SeTcbPrivilege
Process Information: Process ID
0x1714
Process Information: Process Name
C:\Windows\System32\winlogon.exe
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#183 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
BluetoothUserService_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
BluetoothUserService_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k BthAppGroup -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#184 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CaptureService_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CaptureService_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k LocalService -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#185 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
cbdhsvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
cbdhsvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
2
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#186 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CDPUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CDPUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
2
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#187 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CloudBackupRestoreSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CloudBackupRestoreSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#188 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
ConsentUxUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
ConsentUxUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#189 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
CredentialEnrollmentManagerUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
CredentialEnrollmentManagerUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\CredentialEnrollmentManager.exe
Service Information: Service Type
0xd0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#190 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
DeviceAssociationBrokerSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
DeviceAssociationBrokerSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#191 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
DevicePickerUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
DevicePickerUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#192 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
DevicesFlowUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
DevicesFlowUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k DevicesFlow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
5672
#193 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\Start
Details
DWORD (0x00000003)
Event Type
SetValue
Image
C:\WINDOWS\system32\services.exe
Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID
868
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\Start
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.213
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#194 2026-09-29 20:34:36

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225
SP.socpedia.net
NT AUTHORITY\SYSTEM
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\ImagePath
Details
C:\WINDOWS\system32\svchost.exe -k BthAppGroup -p
Event Type
SetValue
Image
C:\WINDOWS\system32\services.exe
Process GUID
{88ea2655-9ca8-6ab2-0b00-000000000700}
Process ID
868
Target Object
HKLM\System\CurrentControlSet\Services\BluetoothUserService_a1cd52d\ImagePath
User
NT AUTHORITY\SYSTEM
UTC Time
2026-09-29 15:34:36.213
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
3516
ThreadID
4260
#195 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
NPSMSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
NPSMSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k LocalService -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#196 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
OneSyncSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
OneSyncSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
2
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#197 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
P9RdrService_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
P9RdrService_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k P9RdrService -p
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#198 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
PimIndexMaintenanceSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
PimIndexMaintenanceSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792
#199 2026-09-29 20:34:36

A new process has been created (4688 "Security")

192.168.0.225
SP.socpedia.net
SP$
Process Information: Process Command Line
sihost.exe
Creator Subject: Security ID
S-1-5-18
Creator Subject: Account Name
SP$
Creator Subject: Account Domain
SOCPEDIA
Creator Subject: Logon ID
0x3e7
Target Subject: Security ID
S-1-0-0
Target Subject: Account Name
localadmin
Target Subject: Account Domain
SOCPEDIA
Target Subject: Logon ID
0xa1beca3
Process Information: New Process ID
0x1ae8
Process Information: Creator Process ID
0xacc
Process Information: New Process Name
C:\Windows\System32\sihost.exe
Process Information: Creator Process Name
C:\Windows\System32\svchost.exe
Process Information: Process Command Line
sihost.exe
Process Information: Token Elevation Type
%%1936
Process Information: Mandatory Label
S-1-16-8192
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
4
ThreadID
7160
#200 2026-09-29 20:34:36

A service was installed in the system (4697 "Security")

192.168.0.225
SP.socpedia.net
SP$
Service Information: Service Name
PrintWorkflowUserSvc_a1cd52d
Subject: Security ID
S-1-5-18
Subject: Account Name
SP$
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x3e7
Service Information: Service Name
PrintWorkflowUserSvc_a1cd52d
Service Information: Service File Name
C:\WINDOWS\system32\svchost.exe -k PrintWorkflow
Service Information: Service Type
0xe0
Service Information: Service Start Type
3
Service Information: Service Account
LocalSystem
IP
192.168.0.225
Computer
SP.socpedia.net
ProcessPID
876
ThreadID
7792

SOCpedia - knowledge platform

This section contains materials on SOC and Blue Team practices: articles, news, books, and translations.

News Blog SOCpedia Library