Kerberos authorization

#401 2026-09-29 20:34:40

Action start (200 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210

DC.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures

Task Information: Task Name: \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Action Name: Feature Configuration Reconciliation Task Handler
Task Instance ID: {a51ba0b2-760b-4717-b370-4090163dd136}
Engine PID: 6588
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 2372
ThreadID: 6452

#402 2026-09-29 20:34:40

Task start event (100 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210

DC.socpedia.net

NT AUTHORITY\SYSTEM

Task Information: Task Name

\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures

Task Information: Task Name: \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
User Context: NT AUTHORITY\SYSTEM
Instance ID: {a51ba0b2-760b-4717-b370-4090163dd136}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 2372
ThreadID: 6452

#403 2026-09-29 20:34:40

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {d062d9b1-2871-6aaa-2c00-000000000b00}
Process ID: 2372
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:40.938
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 832

#404 2026-09-29 20:34:41

A privileged service was called (4673 "Security")

192.168.0.210

DC.socpedia.net

dc_admin

Process: Process Name

C:\Windows\System32\svchost.exe

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name: dc_admin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x71bc577
Service: Server: Security
Service: Service Name: -
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x1b8
Process: Process Name: C:\Windows\System32\svchost.exe
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 4
ThreadID: 3820

#405 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.210

DC.socpedia.net

DC$

Process Information: Process Command Line

"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: DC$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1102
Target Subject: Account Name: dc_admin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0x71bc577
Process Information: New Process ID: 0x1e0c
Process Information: Creator Process ID: 0x1b8
Process Information: New Process Name: C:\Windows\System32\backgroundTaskHost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
Process Information: Token Elevation Type: %%1938
Process Information: Mandatory Label: S-1-16-4096
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 4
ThreadID: 7152

#406 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

SOCPEDIA\dc_admin

Command Line

"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca

Command Line: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
Image: C:\Windows\System32\backgroundTaskHost.exe
Process GUID: {d062d9b1-da91-6abb-002c-000000000b00}
Current Directory: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
Original File Name: backgroundTaskHost.exe
User: SOCPEDIA\dc_admin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {d062d9b1-286d-6aaa-0d00-000000000b00}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=422AE532BC5EE74B13EE0BE406A62C706B81F7EC,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7
Logon GUID: {d062d9b1-a1d5-6ab2-77c5-1b0700000000}
Logon ID: 0x71bc577
Integrity Level: AppContainer
Process ID: 7692
Parent Process ID: 440
Terminal Session ID: 2
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 832

#407 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1814
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\dllhost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7640

#408 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Command Line: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Image: C:\Windows\System32\dllhost.exe
Process GUID: {88ea2655-da91-6abb-cf1d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: dllhost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=F401AE9310FAB4781A3E9FA1EAFF26F3D484C6E0,SHA256=50C9C2EDEA6C51F1AAD2DD80A59F4EDB32637F51714F8472D216E5B9BDACDABF,IMPHASH=FBDAC0471446783AD621D3CAB6033559
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 6164
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#409 2026-09-29 20:34:41

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process: Process Name

C:\Windows\System32\svchost.exe

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0xa1beca3
Service: Server: Security
Service: Service Name: -
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x3e8
Process: Process Name: C:\Windows\System32\svchost.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7640

#410 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1fa8
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-4096
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7640

#411 2026-09-29 20:34:41

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process: Process Name

C:\Windows\System32\svchost.exe

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0xa1beca3
Service: Server: Security
Service: Service Name: -
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x3e8
Process: Process Name: C:\Windows\System32\svchost.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#412 2026-09-29 20:34:41

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x2244
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-4096
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 2272

#413 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

Command Line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Current Directory: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\
Original File Name: SearchHost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=5B675FC608364E49FEA93C3086460BEA1D261E42,SHA256=20BEF4D59D8E5D198CB2FCACDD46721D100773E43CA2D7D5C62515B60CA1D570,IMPHASH=1CD8B57E28B6803311249B05E4E54FDE
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: AppContainer
Process ID: 8104
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#414 2026-09-29 20:34:41

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

Command Line: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Image: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Process GUID: {88ea2655-da91-6abb-d11d-000000000700}
Current Directory: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\
Original File Name: startmenuexperiencehost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=27E5D925410DD26929806A8600248D9366F8C80E,SHA256=B5E184B0B602E3C2C5E58816059AF0C2019AD8F72EE9142ACC26FA567312D3E3,IMPHASH=350F16B9C0052E44E6D5614DC9750D8F
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: AppContainer
Process ID: 8772
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#415 2026-09-29 20:34:42

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\System32\TSTheme.exe

Image: C:\Windows\System32\TSTheme.exe
Process GUID: {88ea2655-da8b-6abb-be1d-000000000700}
Process ID: 7352
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:42.031
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#416 2026-09-29 20:34:42

Action success (201 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210

DC.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures

Task Information: Task Name: \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task Instance ID: {a51ba0b2-760b-4717-b370-4090163dd136}
Action Name: Feature Configuration Reconciliation Task Handler
Result Code: 0
Engine PID: 6588
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 2372
ThreadID: 8264

#417 2026-09-29 20:34:42

Task success event (102 "Microsoft-Windows-TaskScheduler/Operational")

192.168.0.210

DC.socpedia.net

Task Information: Task Name

\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures

Task Information: Task Name: \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
User Context: NT AUTHORITY\SYSTEM
Instance ID: {a51ba0b2-760b-4717-b370-4090163dd136}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 2372
ThreadID: 8264

#418 2026-09-29 20:34:42

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo

Details: Binary Data
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {d062d9b1-2871-6aaa-2c00-000000000b00}
Process ID: 2372
Target Object: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81EB1372-EF88-4F86-A09A-5BF89ED062CC}\DynamicInfo
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:42.500
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 832

#419 2026-09-29 20:34:42

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

NT AUTHORITY\SYSTEM

Image

C:\Windows\System32\taskhostw.exe

Image: C:\Windows\System32\taskhostw.exe
Process GUID: {d062d9b1-da90-6abb-ff2b-000000000b00}
Process ID: 6588
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:42.510
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 832

#420 2026-09-29 20:34:42

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0xd58
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\RuntimeBroker.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#421 2026-09-29 20:34:42

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
Image: C:\Windows\System32\RuntimeBroker.exe
Process GUID: {88ea2655-da92-6abb-d21d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: RuntimeBroker.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=A7B9BC796908A33505B6F65D27D414D72E420B56,SHA256=182FF5D6271D67916B0D6B3F734A5EB02542F9FEE853D6C687807D20152B2E78,IMPHASH=DD3379331F906897D3533DB83F199654
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 3416
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#422 2026-09-29 20:34:42

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x7f4
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\RuntimeBroker.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7640

#423 2026-09-29 20:34:42

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
Image: C:\Windows\System32\RuntimeBroker.exe
Process GUID: {88ea2655-da92-6abb-d31d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: RuntimeBroker.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=A7B9BC796908A33505B6F65D27D414D72E420B56,SHA256=182FF5D6271D67916B0D6B3F734A5EB02542F9FEE853D6C687807D20152B2E78,IMPHASH=DD3379331F906897D3533DB83F199654
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 2036
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#424 2026-09-29 20:34:43

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1b30
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\svchost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 5052

#425 2026-09-29 20:34:43

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc

Command Line: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
Image: C:\Windows\System32\svchost.exe
Process GUID: {88ea2655-da93-6abb-d41d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: svchost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 6960
Parent Process ID: 868
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#426 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

UTC Time: 2026-09-29 15:34:43.167
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device: \Device\HarddiskVolume1
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#427 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

UTC Time: 2026-09-29 15:34:43.169
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device: \Device\HarddiskVolume1
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#428 2026-09-29 20:34:43

The service entered the stopped state (7036 "System")

192.168.0.225

SP.socpedia.net

param1

Udk User Service_a1cd52d

Binary: 550064006B0055007300650072005300760063005F0061003100630064003500320064002F0034000000
param1: Udk User Service_a1cd52d
param2: running
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 868
ThreadID: 2324

#429 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

UTC Time: 2026-09-29 15:34:43.404
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device: \Device\HarddiskVolume1
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#430 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

UTC Time: 2026-09-29 15:34:43.404
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device: \Device\HarddiskVolume1
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#431 2026-09-29 20:34:43

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.225

SP.socpedia.net

Calling Process Name

IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#432 2026-09-29 20:34:43

Attempt to get credential key by call package blocked by Credential Guard (4014 "Microsoft-Windows-NTLM/Operational")

192.168.0.225

SP.socpedia.net

Calling Process Name

IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 7792

#433 2026-09-29 20:34:43

The SMB redirector selected the connection initiated with the following parameters (30830 "Microsoft-Windows-SmbClient/Connectivity")

192.168.0.225

SP.socpedia.net

Server name

DC.socpedia.net

Server name: DC.socpedia.net
Connection Type: 1
Remote Address: 020001BDC0A800D20000000000000000
Instance Name: \Device\LanmanRedirector
Port Origin: 4
Error Code: 0x0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 708
ThreadID: 8724

#434 2026-09-29 20:34:43

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

SP$

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1840
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name: SP$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x12414826
Account Information: Logon GUID: {e565aef3-4045-e464-d379-914fc8beb8f7}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 49159
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#435 2026-09-29 20:34:43

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

SP$

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
New Logon: Account Name: SP$
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x12414826
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-515} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#436 2026-09-29 20:34:43

A network share object was accessed (5140 "Security")

192.168.0.210

DC.socpedia.net

SP$

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x12414826
Network Information: Object Type: File
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 49159
Share Information: Share Name: \\*\IPC$
Access Request Information: Access Mask: 0x1
Access Request Information: Accesses: %%4416
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 4
ThreadID: 7248

#437 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

UTC Time: 2026-09-29 15:34:43.865
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device: \Device\HarddiskVolume1
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#438 2026-09-29 20:34:43

RawAccessRead detected (9 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

UTC Time: 2026-09-29 15:34:43.865
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Device: \Device\HarddiskVolume1
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#439 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7keyboard0\DriverVerVersion

Details: 10.0.26100.1150
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID: 4100
Target Object: \REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7keyboard0\DriverVerVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:44.050
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#440 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7mouse0\DriverVerVersion

Details: 10.0.26100.1
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID: 4100
Target Object: \REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\terminput_bus/umb/2&2c22bcc9&0&session7mouse0\DriverVerVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:44.064
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#441 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\swd/remotedisplayenum/rdpidd_indirectdisplay&sessionid_0007\DriverVerVersion

Details: 10.0.26100.1150
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID: 4100
Target Object: \REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\swd/remotedisplayenum/rdpidd_indirectdisplay&sessionid_0007\DriverVerVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:44.076
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#442 2026-09-29 20:34:44

Registry value set (13 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Target Object

\REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\display/default_monitor/1&5771b5a&0&uid256\DriverVerVersion

Details: 10.0.26100.1150
Event Type: SetValue
Image: C:\WINDOWS\system32\svchost.exe
Process GUID: {88ea2655-9d2f-6ab2-8c00-000000000700}
Process ID: 4100
Target Object: \REGISTRY\A\{df33f646-09f3-aeca-6f06-566e51460d7a}\Root\InventoryDevicePnp\display/default_monitor/1&5771b5a&0&uid256\DriverVerVersion
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:34:44.088
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#443 2026-09-29 20:34:44

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process: Process Name

C:\Windows\System32\RuntimeBroker.exe

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0xa1beca3
Service: Server: Security
Service: Service Name: -
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0xd58
Process: Process Name: C:\Windows\System32\RuntimeBroker.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 4376

#444 2026-09-29 20:34:45

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

/QuitInfo:0000000000000258;000000000000023C;

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0xbfc
Process Information: Creator Process ID: 0xb78
Process Information: New Process Name: C:\Windows\System32\ctfmon.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: /QuitInfo:0000000000000258;000000000000023C;
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8208
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 836

#445 2026-09-29 20:34:45

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

/QuitInfo:0000000000000258;000000000000023C;

Command Line: /QuitInfo:0000000000000258;000000000000023C;
Image: C:\Windows\System32\ctfmon.exe
Process GUID: {88ea2655-da95-6abb-d51d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: CTFMON.EXE
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9cad-6ab2-3800-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=1B3F7B8416C54DA13A51086D7C49412983720B33,SHA256=6DB24A587D68F47705F6BFC5DE76BE716E6A1437C20EB55ACCF2D2ACCDF2A400,IMPHASH=B539389D4BE1DD68C8213A539FEB41FB
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 3068
Parent Process ID: 2936
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#446 2026-09-29 20:34:45

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC.socpedia.net
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: false
Process GUID: {d062d9b1-285a-6aaa-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49159
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:35:44.140
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 4552

#447 2026-09-29 20:34:45

An account was successfully logged on (4624 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Network Information: Source Network Address

-

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Information: Logon Type: 5
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
Account Information: Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information: Process ID: 0x364
Process Information: Process Name: C:\Windows\System32\services.exe
Network Information: Workstation Name: -
Network Information: Source Network Address: -
Network Information: Client Port: -
Detailed Authentication Information: Logon Process: Advapi
Detailed Authentication Information: Authentication Package: Negotiate
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 740

#448 2026-09-29 20:34:45

Special privileges assigned to new logon (4672 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

Privileges

SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

Subject: Security ID: S-1-5-18
Subject: Account Name: SYSTEM
Subject: Account Domain: NT AUTHORITY
Subject: Logon ID: 0x3e7
Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Computer: SP.socpedia.net
ProcessPID: 876
IP: 192.168.0.225
ThreadID: 740

#449 2026-09-29 20:34:45

Group membership information (4627 "Security")

192.168.0.225

SP.socpedia.net

SYSTEM

GroupMembership

%{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}

Subject: Security ID: S-1-5-18
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x3e7
Logon Type: 5
New Logon: Security ID: S-1-5-18
New Logon: Account Name: SYSTEM
New Logon: Account Domain: NT AUTHORITY
New Logon: Logon ID: 0x3e7
GroupMembership: %{S-1-5-32-544} %{S-1-1-0} %{S-1-5-11} %{S-1-16-16384}
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 876
ThreadID: 740

#450 2026-09-29 20:34:45

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0xfcc
Process Information: Creator Process ID: 0x364
Process Information: New Process Name: C:\Windows\System32\svchost.exe
Process Information: Creator Process Name: C:\Windows\System32\services.exe
Process Information: Process Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-16384
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 5052

#451 2026-09-29 20:34:45

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

NT AUTHORITY\SYSTEM

Command Line

C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc

Command Line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc
Image: C:\Windows\System32\svchost.exe
Process GUID: {88ea2655-da95-6abb-d61d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: svchost.exe
User: NT AUTHORITY\SYSTEM
Parent Command Line: C:\WINDOWS\system32\services.exe
Parent Image: C:\Windows\System32\services.exe
Parent Process GUID: {88ea2655-9ca8-6ab2-0b00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=55EFB424933087D755B18468BC574DB4463D9CE6,SHA256=324451797AC909A4DD40C7A2F7347EF91F6B7C786941AD5035F609C0FC15EDAA,IMPHASH=DE43BD45CC98C143357416C7519ECCFD
Logon GUID: {88ea2655-9ca9-6ab2-e703-000000000000}
Logon ID: 0x3e7
Integrity Level: System
Process ID: 4044
Parent Process ID: 868
Terminal Session ID: 0
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#452 2026-09-29 20:34:45

The service entered the stopped state (7036 "System")

192.168.0.225

SP.socpedia.net

param1

Windows Insider Service

Binary: 770069007300760063002F0034000000
param1: Windows Insider Service
param2: running
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 868
ThreadID: 8424

#453 2026-09-29 20:34:45

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 445
DestinationPortName: microsoft-ds
Image: System
Initiated: true
Process GUID: {88ea2655-9c98-6ab2-eb03-000000000000}
Process ID: 4
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: SP.socpedia.net
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49159
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:35:42.281
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4272

#454 2026-09-29 20:34:45

File creation time changed (2 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Target Filename

C:\Users\localadmin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp

UTC Time: 2026-09-29 15:34:45.798
Process GUID: {88ea2655-da91-6abb-d11d-000000000700}
Process ID: 8772
Image: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Target Filename: C:\Users\localadmin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
Creation UTC Time: 2026-09-28 16:29:34.178
Previous Creation UTC Time: 2026-09-29 15:34:45.664
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#455 2026-09-29 20:34:46

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process: Process Name

C:\Windows\System32\svchost.exe

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0xa1beca3
Service: Server: Security
Service: Service Name: -
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x3e8
Process: Process Name: C:\Windows\System32\svchost.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 9024

#456 2026-09-29 20:34:46

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

"C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1fbc
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\backgroundTaskHost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: "C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-4096
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 9024

#457 2026-09-29 20:34:46

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

"C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

Command Line: "C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
Image: C:\Windows\System32\backgroundTaskHost.exe
Process GUID: {88ea2655-da96-6abb-d71d-000000000700}
Current Directory: C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\
Original File Name: backgroundTaskHost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=422AE532BC5EE74B13EE0BE406A62C706B81F7EC,SHA256=B7D2C17E0038945AA4B72AE7A89E54D29B04CCC0FEB62DF5C9B7B67DE43C2530,IMPHASH=DC601E2593053A84A6989DE251407AA7
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: AppContainer
Process ID: 8124
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#458 2026-09-29 20:34:46

File creation time changed (2 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Target Filename

C:\Users\localadmin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp

UTC Time: 2026-09-29 15:34:46.367
Process GUID: {88ea2655-da91-6abb-d01d-000000000700}
Process ID: 8104
Image: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
Target Filename: C:\Users\localadmin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
Creation UTC Time: 2026-09-28 16:29:35.179
Previous Creation UTC Time: 2026-09-29 15:34:46.322
User: SOCPEDIA\localadmin
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#459 2026-09-29 20:34:46

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x2204
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\RuntimeBroker.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 4376

#460 2026-09-29 20:34:46

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
Image: C:\Windows\System32\RuntimeBroker.exe
Process GUID: {88ea2655-da96-6abb-d81d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: RuntimeBroker.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=A7B9BC796908A33505B6F65D27D414D72E420B56,SHA256=182FF5D6271D67916B0D6B3F734A5EB02542F9FEE853D6C687807D20152B2E78,IMPHASH=DD3379331F906897D3533DB83F199654
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 8708
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#461 2026-09-29 20:34:46

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x12414895
Account Information: Logon GUID: {3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 49162
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#462 2026-09-29 20:34:46

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

localadmin

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x12414895
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#463 2026-09-29 20:34:46

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x124148b0
Account Information: Logon GUID: {3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 49163
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#464 2026-09-29 20:34:46

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

localadmin

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x124148b0
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#465 2026-09-29 20:34:46

An account was successfully logged on (4624 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Network Information: Source Network Address

192.168.0.225

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Information: Logon Type: 3
Logon Information: Restricted Admin Mode: -
Logon Information: Remote Credential Guard: -
ImpersonationLevel: %%1833
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x124148c4
Account Information: Logon GUID: {3f2d11e1-e045-6611-5645-ce407194aeba}
Process Information: Process ID: 0x0
Process Information: Process Name: -
Network Information: Workstation Name: -
Network Information: Source Network Address: 192.168.0.225
Network Information: Client Port: 49164
Detailed Authentication Information: Logon Process: Kerberos
Detailed Authentication Information: Authentication Package: Kerberos
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#466 2026-09-29 20:34:46

Group membership information (4627 "Security")

192.168.0.210

DC.socpedia.net

localadmin

GroupMembership

%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}

Subject: Security ID: S-1-0-0
Subject: Account Name: -
Subject: Account Domain: -
Subject: Logon ID: 0x0
Logon Type: 3
New Logon: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
New Logon: Account Name: localadmin
New Logon: Account Domain: SOCPEDIA.NET
New Logon: Logon ID: 0x124148c4
GroupMembership: %{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-18-1} %{S-1-16-8448}
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 7144

#467 2026-09-29 20:34:46

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Logon Type

3

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x124148c4
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#468 2026-09-29 20:34:46

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Logon Type

3

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x124148b0
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#469 2026-09-29 20:34:46

DNS query (22 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Query Name

DC.socpedia.net

Image: C:\Windows\System32\backgroundTaskHost.exe
Process GUID: {88ea2655-da96-6abb-d71d-000000000700}
Process ID: 8124
Query Name: DC.socpedia.net
Query Results: ::ffff:192.168.0.210;
Query Status: 0
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:46.716
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 5236

#470 2026-09-29 20:34:47

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\System32\dllhost.exe

Image: C:\Windows\System32\dllhost.exe
Process GUID: {88ea2655-da91-6abb-cf1d-000000000700}
Process ID: 6164
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:47.154
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#471 2026-09-29 20:34:47

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

DestinationIp

52.110.17.59

DestinationHostname: -
DestinationIp: 52.110.17.59
DestinationIsIpv6: false
DestinationPort: 443
DestinationPortName: https
Image: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Initiated: true
Process GUID: {88ea2655-da91-6abb-d11d-000000000700}
Process ID: 8772
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: SP.socpedia.net
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49160
SourcePortName: -
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:35:44.558
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4272

#472 2026-09-29 20:34:47

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC.socpedia.net
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 49684
DestinationPortName: -
Image: C:\Windows\System32\lsass.exe
Initiated: false
Process GUID: {d062d9b1-2863-6aaa-0c00-000000000b00}
Process ID: 844
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49162
SourcePortName: -
User: NT AUTHORITY\SYSTEM
UTC Time: 2026-09-29 15:35:47.034
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 4552

#473 2026-09-29 20:34:47

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.210

DC.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC.socpedia.net
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 135
DestinationPortName: epmap
Image: C:\Windows\System32\svchost.exe
Initiated: false
Process GUID: {d062d9b1-286e-6aaa-0e00-000000000b00}
Process ID: 988
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: -
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49161
SourcePortName: -
User: NT AUTHORITY\NETWORK SERVICE
UTC Time: 2026-09-29 15:35:47.024
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 3844
ThreadID: 4552

#474 2026-09-29 20:34:48

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\System32\mobsync.exe -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x1508
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\mobsync.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\WINDOWS\System32\mobsync.exe -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 9024

#475 2026-09-29 20:34:48

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\System32\backgroundTaskHost.exe

Image: C:\Windows\System32\backgroundTaskHost.exe
Process GUID: {88ea2655-da96-6abb-d71d-000000000700}
Process ID: 8124
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:48.006
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#476 2026-09-29 20:34:48

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\WINDOWS\System32\mobsync.exe -Embedding

Command Line: C:\WINDOWS\System32\mobsync.exe -Embedding
Image: C:\Windows\System32\mobsync.exe
Process GUID: {88ea2655-da98-6abb-d91d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: mobsync.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=B67DABA43D37829B39D5F5D39E13F53771466205,SHA256=DC95D8C153AD3B004819BC9F18C3F5BB98B70CF8B243EA32736C895A9A370A69,IMPHASH=0303D470D1699A284C1DC4CCDF502016
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 5384
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#477 2026-09-29 20:34:48

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

localadmin

Logon Type

3

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x12414895
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#478 2026-09-29 20:34:48

An account was logged off (4634 "Security")

192.168.0.210

DC.socpedia.net

SP$

Logon Type

3

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1134
Subject: Account Name: SP$
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0x1240cede
Logon Type: 3
IP: 192.168.0.210
Computer: DC.socpedia.net
ProcessPID: 844
ThreadID: 720

#479 2026-09-29 20:34:48

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 135
DestinationPortName: epmap
Image: <unknown process>
Initiated: true
Process GUID: {00000000-0000-0000-0000-000000000000}
Process ID: 8124
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: SP.socpedia.net
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49161
SourcePortName: -
User: -
UTC Time: 2026-09-29 15:35:45.165
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4272

#480 2026-09-29 20:34:48

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

DestinationIp

52.110.17.62

DestinationHostname: -
DestinationIp: 52.110.17.62
DestinationIsIpv6: false
DestinationPort: 443
DestinationPortName: https
Image: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Initiated: true
Process GUID: {88ea2655-da91-6abb-d11d-000000000700}
Process ID: 8772
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: SP.socpedia.net
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49165
SourcePortName: -
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:35:45.347
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4272

#481 2026-09-29 20:34:49

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\System32\rundll32.exe

Image: C:\Windows\System32\rundll32.exe
Process GUID: {88ea2655-da8f-6abb-ce1d-000000000700}
Process ID: 8848
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:49.365
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#482 2026-09-29 20:34:49

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

DestinationIp

192.168.0.210

DestinationHostname: DC
DestinationIp: 192.168.0.210
DestinationIsIpv6: false
DestinationPort: 49684
DestinationPortName: -
Image: <unknown process>
Initiated: true
Process GUID: {00000000-0000-0000-0000-000000000000}
Process ID: 8124
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: SP.socpedia.net
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49162
SourcePortName: -
User: -
UTC Time: 2026-09-29 15:35:45.175
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4272

#483 2026-09-29 20:34:49

Network connection (3 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

DestinationIp

40.126.35.151

DestinationHostname: -
DestinationIp: 40.126.35.151
DestinationIsIpv6: false
DestinationPort: 443
DestinationPortName: https
Image: <unknown process>
Initiated: true
Process GUID: {00000000-0000-0000-0000-000000000000}
Process ID: 8124
Protocol: tcp
RuleName: v1-0_eventID3
SourceHostname: SP.socpedia.net
SourceIp: 192.168.0.225
SourceIsIpv6: false
SourcePort: 49166
SourcePortName: -
User: -
UTC Time: 2026-09-29 15:35:45.664
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4272

#484 2026-09-29 20:34:49

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\Windows\System32\smartscreen.exe -Embedding

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x128c
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\smartscreen.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\Windows\System32\smartscreen.exe -Embedding
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

#485 2026-09-29 20:34:49

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\Windows\System32\smartscreen.exe -Embedding

Command Line: C:\Windows\System32\smartscreen.exe -Embedding
Image: C:\Windows\System32\smartscreen.exe
Process GUID: {88ea2655-da99-6abb-da1d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: smartscreen.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=625D5080A3972689A71B8024B8499FDBBF80DC7C,SHA256=3FBFE0A811CB59312EF7597EE0F4FEC6EF1576F5FF0828A7F79FA5C30FC20305,IMPHASH=460054574AFB80F85A81443C12C1A3D8
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 4748
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#486 2026-09-29 20:34:49

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process Information: Process Command Line

"C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"

Creator Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Creator Subject: Account Name: localadmin
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0xa1beca3
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0x2224
Process Information: Creator Process ID: 0x23e4
Process Information: New Process Name: C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Process Information: Creator Process Name: C:\Windows\explorer.exe
Process Information: Process Command Line: "C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 4376

#487 2026-09-29 20:34:49

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

"C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"

Command Line: "C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe"
Image: C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Process GUID: {88ea2655-da99-6abb-db1d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: -
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\Explorer.EXE
Parent Image: C:\Windows\explorer.exe
Parent Process GUID: {88ea2655-da8d-6abb-cb1d-000000000700}
Parent User: SOCPEDIA\localadmin
Hashes: SHA1=8FCE93EA0FD1D2EA9833D3AA86E4BEBD39A502A7,SHA256=CC4B21143E027F7623BF3F01F49C4E774F42987FD74C5D7E0B8B160EAC6C8991,IMPHASH=3077DAB08EA098FD564AF382CAE8B6E9
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 8740
Parent Process ID: 9188
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#488 2026-09-29 20:34:49

A privileged service was called (4673 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process: Process Name

C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe

Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Subject: Account Name: localadmin
Subject: Account Domain: SOCPEDIA
Subject: Logon ID: 0xa1beca3
Service: Server: Security
Service: Service Name: -
Service Request Information: Privileges: SeTcbPrivilege
Process: Process ID: 0x2224
Process: Process Name: C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 3116

#489 2026-09-29 20:34:49

Process terminated (5 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Image

C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe

Image: C:\Windows\AzureArcSetup\Systray\AzureArcSysTray.exe
Process GUID: {88ea2655-da99-6abb-db1d-000000000700}
Process ID: 8740
User: SOCPEDIA\localadmin
UTC Time: 2026-09-29 15:34:49.761
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#490 2026-09-29 20:34:49

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

SP$

Process Information: Process Command Line

C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Creator Subject: Security ID: S-1-5-18
Creator Subject: Account Name: SP$
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0x3e7
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: localadmin
Target Subject: Account Domain: SOCPEDIA
Target Subject: Logon ID: 0xa1beca3
Process Information: New Process ID: 0x21bc
Process Information: Creator Process ID: 0x3e8
Process Information: New Process Name: C:\Windows\System32\dllhost.exe
Process Information: Creator Process Name: C:\Windows\System32\svchost.exe
Process Information: Process Command Line: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 3116

#491 2026-09-29 20:34:49

Process Create (1 "Microsoft-Windows-Sysmon/Operational")

192.168.0.225

SP.socpedia.net

SOCPEDIA\localadmin

Command Line

C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Command Line: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Image: C:\Windows\System32\dllhost.exe
Process GUID: {88ea2655-da99-6abb-dc1d-000000000700}
Current Directory: C:\WINDOWS\system32\
Original File Name: dllhost.exe
User: SOCPEDIA\localadmin
Parent Command Line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
Parent Image: C:\Windows\System32\svchost.exe
Parent Process GUID: {88ea2655-9ca9-6ab2-0d00-000000000700}
Parent User: NT AUTHORITY\SYSTEM
Hashes: SHA1=F401AE9310FAB4781A3E9FA1EAFF26F3D484C6E0,SHA256=50C9C2EDEA6C51F1AAD2DD80A59F4EDB32637F51714F8472D216E5B9BDACDABF,IMPHASH=FBDAC0471446783AD621D3CAB6033559
Logon GUID: {88ea2655-da8a-6abb-a3ec-1b0a00000000}
Logon ID: 0xa1beca3
Integrity Level: Medium
Process ID: 8636
Parent Process ID: 1000
Terminal Session ID: 7
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 3516
ThreadID: 4260

#492 2026-09-29 20:34:50

A new process has been created (4688 "Security")

192.168.0.225

SP.socpedia.net

localadmin

Process Information: Process Command Line

"C:\Windows\System32\SecurityHealthSystray.exe"

Creator Subject: Security ID: S-1-5-21-1838030176-2987033226-1986555923-1140
Creator Subject: Account Name: localadmin
Creator Subject: Account Domain: SOCPEDIA
Creator Subject: Logon ID: 0xa1beca3
Target Subject: Security ID: S-1-0-0
Target Subject: Account Name: -
Target Subject: Account Domain: -
Target Subject: Logon ID: 0x0
Process Information: New Process ID: 0xa54
Process Information: Creator Process ID: 0x23e4
Process Information: New Process Name: C:\Windows\System32\SecurityHealthSystray.exe
Process Information: Creator Process Name: C:\Windows\explorer.exe
Process Information: Process Command Line: "C:\Windows\System32\SecurityHealthSystray.exe"
Process Information: Token Elevation Type: %%1936
Process Information: Mandatory Label: S-1-16-8192
IP: 192.168.0.225
Computer: SP.socpedia.net
ProcessPID: 4
ThreadID: 7160

Event Title
Event ID
Access Request Information: Access Mask
Access Request Information: Accesses
Account Information: Logon GUID
Account Whose Credentials Were Used: Logon GUID
Action Name
Added Rule: Rule ID
Additional Information: Pre-Authentication Type
Additional Information: Privileges
Additional Information: Ticket Options
Binary
Call Trace
Calling Process Name
Certificate Information: Certificate Issuer Name
Certificate Information: Certificate Serial Number
Certificate Information: Certificate Thumbprint
Class ID
Class Name
Client certificate thumbprint
ClientMachine
Code
Compatible IDs
Component
Computer
Computer Account That Was Changed: Account Name
Connection ID
Connection Type
Count Of Credentials Returned
Creation UTC Time
Creator Subject: Account Domain
Creator Subject: Logon ID
Creator Subject: Security ID
Cryptographic Parameters: Algorithm Name
Cryptographic Parameters: Key Name
Cryptographic Parameters: Key Type
Cryptographic Parameters: Provider Name
Current Directory
DestinationHostname
DestinationIp
DestinationIsIpv6
DestinationPort
DestinationPortName
Detailed Authentication Information: Authentication Package
Details
Device
Device ID
Device Name
Domain
Engine PID
Event Type
Failure Information: Status
Granted Access
Group: Group Domain
Group: Security ID
GroupMembership
Hashes
Host Process
Id
Image
ImpersonationLevel
Initiated
Instance ID
Instance Name
Integrity Level
IP
Is Executable
Key File Operation Information: File Path
Key File Operation Information: Operation
Listener Name
Local Address
Location Information
Logon ID
Logon Information: Remote Credential Guard
Logon Information: Restricted Admin Mode
Logon Process Name
Logon Type
Network Information: Client Address
Network Information: Object Type
Network Information: Port
Network Information: Workstation Name
New Logon: Logon ID
New Thread ID
Object: Handle ID
Object: Object Name
Object: Object Server
Original File Name
Other Information: FQDN
Other Information: ParentProcessId
Other Information: ProcessCreationTime
Other Information: RpcCallClientLocality
param1
param2
Param3
Parent Command Line
Parent Image
Parent Process GUID
Parent Process Name
Parent User
Path
Port Origin
PossibleCause
Previous Creation UTC Time
Priority
Process
Process Creation Time
Process GUID
Process ID
Process Information: Caller Process ID
Process Information: Mandatory Label
Process Information: New Process ID
Process Information: New Process Name
Process Information: Process Command Line
Process Information: Process Creation Time
Process Information: Process ID
Process Information: Process ID
Process Information: Process Name
Process Information: Token Elevation Type
ProcessPID
Profile Changed
Protocol
Provider Path
Query Name
Query Results
Query Status
Remote Address
Result Code
Return Code
RuleName
Server name
Service Host Tag
Service Information: Service Account
Service Information: Service File Name
Service Information: Service Name
Service Information: Service Start Type
Service Information: Service Type
Service: Service Name
ServiceSid
Session ID
Share Information: Share Name
Share Information: Share Path
Source Image
Source Network Address
Source Process GUID
Source Process GUID
Source Process ID
Source Thread ID
Source User
SourceHostname
SourceIp
SourceIsIpv6
SourcePort
SourcePortName
Start Address
Start Function
Start Module
Subject: Account Name
Subject: Read Operation
Subject: Security ID
Target Filename
Target Image
Target Name
Target Object
Target Process GUID
Target Process GUID
Target Process ID
Target Server: Additional Information
Target Server: Target Server Name
Target User
Task Information: Task Name
Task Information: Task New Content
Task Instance ID
Terminal Session ID
ThreadID
Ticket information: Request ticket hash
Ticket information: Response ticket hash
Ticket information: Response ticket hash
TicketEncryptionType
Transmitted Services
TS ID
Type
User
User
User
User Context
User SID
UTC Time
Vendor IDs